Privacy policy
Privacy Policy
Last updated: September 28, 2026
1. Controller
The controller responsible for the processing of personal data in connection with this website and the online shop auri-shop.com is:
Elias Harmanus
Sole proprietor
c/o SP-Day Impressum-Service
Dr. Lutz Kreutzer
Hauptstraße 8
83395 Freilassing
Germany
Email: aurimangaka@gmail.com
This address is intended exclusively for receiving letter mail. Please do not send parcels or packages to this address.
Auri-shop operates this online shop and the associated website, including the content, functions, products and services provided, hereinafter collectively referred to as the “Services”.
The online shop is operated via the Shopify e-commerce platform.
This Privacy Policy explains which personal data are processed when using our Services, for what purposes this takes place, on which legal basis the processing is carried out, and which rights data subjects have.
2. What are personal data?
Personal data are information relating to an identified or identifiable natural person.
This includes, for example:
-
Name
-
Address
-
Email address
-
Telephone number
-
IP address
-
Order data
-
Payment information
-
Device and browser information
-
Customer account information
-
Communication content
Anonymous data or data that have been anonymised in such a way that a person can no longer be identified are not considered personal data.
3. Which personal data do we process?
Depending on how you use our website and our shop, the following data in particular may be processed:
3.1 Contact and customer data
This includes in particular:
-
First and last name
-
Billing address
-
Shipping address
-
Email address
-
Telephone number, if provided
-
Other contact information provided by you
These data are used in particular for processing orders, customer enquiries, deliveries, returns and other communications.
3.2 Order and transaction data
In connection with an order, the following may in particular be processed:
-
Products ordered
-
Order number
-
Order date
-
Order value
-
Delivery status
-
Returns
-
Refunds
-
Cancellations
-
Payment status
-
Payment method used
-
Information about previous orders
This may also include information about which products you add to the shopping cart or view as part of the shop functions.
3.3 Payment information
For payment processing, the necessary data are processed depending on the payment method selected.
These may include:
-
Name
-
Billing address
-
Email address
-
Order amount
-
Currency
-
Transaction ID
-
Payment method
-
Payment status
-
Where applicable, IP address or device information for fraud prevention
Complete credit card or bank details are generally processed by the respective payment service providers and are not made fully available to us.
Depending on the payment method offered at checkout, the following payment methods may be available, for example:
-
Visa
-
Mastercard
-
Apple Pay
-
Google Pay
-
Klarna
-
PayPal
-
Revolut
-
Blink
The payment methods actually available to you will be displayed at checkout.
For payment processing, the respective payment service providers integrated into Shopify may process personal data under their own or joint data protection responsibility.
4. Device, usage and technical data
When visiting our website, technical information may be processed automatically.
This may include in particular:
-
IP address
-
Browser type and browser version
-
Operating system
-
Device type
-
Language settings
-
Date and time of access
-
Pages accessed
-
Referrer URL
-
Network and connection information
-
Cookie and session information
-
Interactions with our website
These data may in particular be processed by Shopify and the technical systems used to provide the shop.
The processing serves in particular to technically provide the shop, ensure the stability and security of the website and detect misuse and technical problems.
5. Sources of personal data
Personal data may come from the following sources:
Directly from you
For example, when you:
-
Place an order
-
Create a customer account
-
Send us an email
-
Use a contact form
-
Subscribe to a newsletter
-
Carry out a return or complaint
-
Otherwise communicate with us
Automatically via our website
Certain technical data may be collected automatically when you visit or use our website.
Cookies and similar technologies may be used for this purpose.
From service providers
We may receive personal data from service providers that act on our behalf or in connection with the provision of our shop.
These include in particular Shopify, payment service providers and shipping service providers.
6. Legal bases for processing
We process personal data only where there is a legal basis for doing so.
6.1 Performance of a contract – Art. 6 Abs. 1 lit. b DSGVO
Personal data are processed where this is necessary for the implementation of pre-contractual measures or for the performance of a contract.
This applies in particular to:
-
Processing orders
-
Payment processing
-
Delivery of goods
-
Administration of a customer account
-
Processing returns and refunds
-
Communication regarding an order
-
Processing complaints
-
Performance of other services requested by the customer
6.2 Legal obligations – Art. 6 Abs. 1 lit. c DSGVO
Certain data must be processed or retained in order to comply with legal obligations.
These include in particular tax and commercial law documentation and retention obligations.
6.3 Legitimate interests – Art. 6 Abs. 1 lit. f DSGVO
Where necessary, we process personal data on the basis of legitimate interests.
These include in particular:
-
Protection of our website and IT systems
-
Fraud prevention
-
Detection of misuse
-
IT security
-
Stability and functionality of the shop
-
Defence and enforcement of legal claims
-
Improvement of our customer service
-
Economical and secure operation of the online shop
In doing so, we take into account the interests, fundamental rights and fundamental freedoms of data subjects.
6.4 Consent – Art. 6 Abs. 1 lit. a DSGVO
Where processing requires consent, it takes place only after the corresponding consent has been given.
This may apply in particular to:
-
Newsletters
-
Certain marketing measures
-
Cookies that are not technically necessary
-
Analytics and tracking technologies
-
Personalised advertising
-
Certain transfers of the email address to shipping service providers
Consent that has been granted may be withdrawn at any time with effect for the future.
The lawfulness of the processing carried out up to the time of withdrawal remains unaffected.
7. Shopify
Our online shop is provided via the Shopify platform.
For merchants in the European Economic Area, the following Shopify company is generally relevant:
Shopify International Limited
Victoria Buildings
2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify provides us with the technical infrastructure we need to operate our online shop.
In this context, personal data may be processed by Shopify.
This includes, for example:
-
Contact details
-
Order data
-
Payment and transaction information
-
Device information
-
IP address
-
Browser information
-
Usage information
-
Cookie and session information
Shopify may act as a processor for us in connection with certain processing activities.
For certain of its own or enhanced Shopify services, Shopify may also process personal data under its own data protection responsibility.
Further information about the processing of personal data by Shopify can be found in Shopify’s Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers
The Shopify Privacy Portal is available at:
8. Shopify Network Intelligence and enhanced Shopify Services
Where Shopify Network Intelligence is enabled in our shop and corresponding enhanced Shopify Services are used, Shopify may process information from interactions with our shop together with information from interactions with Shopify and other Shopify merchants.
This may be used, for example, to:
-
Personalise the shopping experience
-
Improve products and shop functions
-
Analyse shop performance
-
Prevent fraud
-
Provide more relevant advertising
-
Understand how customers interact with shops and advertising
Other Shopify merchants do not receive direct access to our customer data as a result.
Where consent is required for such processing under applicable law, processing takes place only after the corresponding consent has been given, for example via the cookie or privacy banner.
Consent that has been granted may be withdrawn via the privacy settings provided.
Further information and options for exercising data protection rights vis-à-vis Shopify can be found at:
9. Payment service providers
We use payment service providers to process payments.
Which service providers are used depends on the payment method selected at checkout.
The following personal data in particular may be transferred:
-
First and last name
-
Billing address
-
Where applicable, shipping address
-
Email address
-
Order amount
-
Currency
-
Transaction information
-
Payment method
-
Payment status
-
Where applicable, IP address and device information for fraud prevention
The legal basis for processing necessary to carry out the payment is generally Art. 6 Abs. 1 lit. b DSGVO.
In addition, payment service providers may process personal data on the basis of their own legal obligations or legitimate interests, for example for fraud prevention, anti-money laundering measures or compliance with financial regulations.
For these processing activities, the privacy notices of the respective payment service provider also apply.
10. Shipping and DHL
For the shipping of our physical products, we use in particular:
DHL Paket GmbH / Deutsche Post DHL Group
For the purpose of carrying out delivery, the following data in particular may be transferred:
-
First and last name
-
Shipping address
-
Where applicable, telephone number
-
Shipping or order reference
The transfer required for delivery is generally carried out on the basis of Art. 6 Abs. 1 lit. b DSGVO, as the data are required for the performance of the purchase contract and delivery of the goods ordered.
DHL shipping notifications
Where your email address is transferred to DHL so that DHL itself can send you shipping announcements, shipment tracking information or delivery notifications, this transfer takes place only where the necessary legal basis under data protection law exists.
Where consent is required, your email address will only be transferred to DHL for this purpose after you have given the corresponding consent.
The email address may be processed by DHL within the scope of this transfer for the corresponding shipping and delivery information.
11. Cookies and similar technologies
Our website uses cookies and comparable technologies.
Cookies are small files or pieces of information that may be stored on your device or read from it.
11.1 Technically necessary cookies
Certain cookies and technical storage operations are necessary for our online shop to function.
They may be required, for example, for:
-
Shopping cart functions
-
Checkout
-
Login and customer account
-
Language settings
-
Security functions
-
Session management
-
Fraud prevention
-
Storage of privacy settings
Where storing or accessing information on your device is strictly necessary in order to provide a digital service expressly requested by you, this takes place on the basis of § 25 Abs. 2 Nr. 2 TDDDG.
Where personal data are processed in this context, the legal basis is determined in particular by Art. 6 Abs. 1 lit. b or lit. f DSGVO.
11.2 Analytics, marketing and other non-essential technologies
Where analytics, marketing, personalisation or other technologies that are not strictly necessary are used, we generally use these, within the scope of § 25 Abs. 1 TDDDG, only after you have given your consent.
Further processing of personal data in these cases is generally carried out on the basis of Art. 6 Abs. 1 lit. a DSGVO.
You can withdraw or change consent that has been granted at any time for the future via the privacy or cookie settings provided on our website.
The specific technologies used may depend on the Shopify functions, apps and integrations that we have enabled.
12. Server log files
When using our website, technical access data may be processed.
These may include:
-
IP address
-
Date and time
-
Page accessed
-
Referrer URL
-
Browser type
-
Browser version
-
Operating system
-
Device information
These data are used in particular for technical provision, error analysis, stability and security of the website.
Where processing is not already necessary for the performance of a contract, the legal basis is generally Art. 6 Abs. 1 lit. f DSGVO.
Technical log data are generally processed only for as long as this is necessary for the respective security, operational or error-analysis purpose.
In the event of security incidents or specific cases of suspicion, longer storage may be necessary.
13. Customer account
Where you can create a customer account in our shop, we process the data required to set up and manage the account.
These may include in particular:
-
Name
-
Email address
-
Shipping and billing addresses
-
Order history
-
Account settings
-
Authentication information
Processing is generally carried out for the provision of the requested account function on the basis of Art. 6 Abs. 1 lit. b DSGVO.
14. Communication and customer service
If you contact us, for example by email or via a contact form, we process the information you provide.
This may include:
-
Name
-
Email address
-
Order number
-
Content of your message
-
Images or files submitted
-
Other information voluntarily provided by you
If your enquiry relates to an order or a contract, processing is generally carried out on the basis of Art. 6 Abs. 1 lit. b DSGVO.
For general enquiries, processing is generally carried out on the basis of our legitimate interest in processing customer and business enquiries pursuant to Art. 6 Abs. 1 lit. f DSGVO.
15. Newsletters and marketing emails
Where we offer a newsletter or comparable marketing communication, it is generally sent only after the corresponding consent has been given.
The legal basis is Art. 6 Abs. 1 lit. a DSGVO.
You can unsubscribe at any time via the unsubscribe link in the respective message or by contacting aurimangaka@gmail.com.
The withdrawal applies for the future.
Transaction-related messages, for example order confirmations, payment information or information relating to an order, may continue to be sent independently of a newsletter subscription.
Evidence of consent that has been granted may be retained for an appropriate period where this is necessary to comply with legal obligations to provide evidence or to defend against possible legal claims.
16. Marketing and personalised advertising
Where we use marketing or advertising services, personal data may be processed for the delivery, measurement or personalisation of advertising.
This may include in particular:
-
Device information
-
IP address
-
Cookie identifiers
-
Information about products viewed
-
Shopping cart contents
-
Purchases
-
Interactions with advertising
Where consent is required for this, this processing takes place only on the basis of your prior consent pursuant to Art. 6 Abs. 1 lit. a DSGVO in conjunction with the relevant provisions of the TDDDG.
You can withdraw consent at any time via the privacy or cookie settings.
17. Security and fraud prevention
We and our service providers may process personal data in order to:
-
Detect fraudulent transactions
-
Prevent misuse
-
Protect accounts and orders
-
Ensure the security of the shop
-
Detect technical attacks and manipulation
Where the processing is not already necessary for the performance of a contract, it is generally carried out on the basis of our legitimate interest pursuant to Art. 6 Abs. 1 lit. f DSGVO.
Payment providers and Shopify may additionally use their own fraud and risk detection systems.
18. Disclosure of personal data
We do not sell your personal data to third parties in the traditional sense.
However, where necessary and legally permitted, personal data may be disclosed to the following categories of recipients:
-
Shopify
-
Payment service providers
-
Banks and payment networks
-
Shipping and logistics service providers
-
IT and hosting service providers
-
Technical service providers
-
Analytics and marketing service providers, where permitted
-
Tax advisers or other professional advisers
-
Authorities or courts, where there is a legal obligation
Data are disclosed only where a corresponding legal basis exists.
19. International data transfers
As our online shop is operated via Shopify and other international service providers may also be used, personal data may also be processed outside Germany or outside the European Economic Area.
In particular, Shopify may transfer personal data to affiliated companies and selected subprocessors in other countries.
Shopify International Limited, based in Ireland, is generally the relevant Shopify contracting entity for merchants in the European Economic Area.
Nevertheless, data may also be processed in other countries as part of the provision of Shopify Services.
Where data are transferred to countries outside the European Economic Area, appropriate safeguards pursuant to Art. 44 ff. DSGVO are used where required.
These may include in particular:
-
Adequacy decisions of the European Commission
-
Standard Contractual Clauses of the European Commission
-
Other legally permitted safeguards
Further information on this is provided by Shopify in its privacy information.
20. Third-party websites and services
Our website may contain links to third-party websites or services.
If you access such a link, you may leave our area of responsibility.
The privacy policies of the respective provider apply to the processing of personal data on external websites.
We generally have no influence on the data processing carried out by these external providers.
21. Retention period
We generally store personal data only for as long as they are needed for the respective purpose or where statutory retention obligations exist.
The specific period depends on the type and purpose of the data.
21.1 Order, invoice and accounting data
Certain documents relating to orders and business transactions must be retained due to statutory obligations under commercial and tax law.
Accounting records and invoices in Germany are generally subject to a statutory retention period of eight years.
For certain other tax and commercial records, retention periods of six or ten years may apply depending on the type of document.
After expiry of the respective statutory retention period, the data are generally deleted unless another legal basis for further storage exists.
21.2 Customer communication
Enquiries and communications are generally stored for as long as this is necessary to process the respective matter.
Further storage may take place where this is required due to legal obligations or for the establishment, exercise or defence of legal claims.
21.3 Customer account
Data relating to a customer account are generally processed for as long as the customer account exists or the data are required for the handling of existing contractual relationships.
Statutory retention obligations remain unaffected.
21.4 Technical data
Technical log and security data are generally processed only for as long as this is necessary for the respective technical or security-related purpose.
In the event of specific security incidents, longer storage may be necessary.
21.5 Newsletter
Data for sending newsletters are generally processed until you withdraw your consent or unsubscribe.
Evidence of consent that has been granted may additionally be stored for an appropriate period where this is necessary to comply with obligations to provide evidence or to defend against possible legal claims.
22. Data protection rights
Where the legal requirements are met, you have in particular the following rights:
Right of access
You may request information as to whether and which personal data we process about you.
Right to rectification
You may request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure
Under the legal requirements, you may request the deletion of your personal data.
Statutory retention obligations may prevent immediate deletion.
Right to restriction of processing
Under the legal requirements, you may request that the processing of your personal data be restricted.
Right to data portability
Where the legal requirements are met, you may receive personal data that you have provided to us in a structured, commonly used and machine-readable format or request that they be transmitted to another controller.
Right to object
Where personal data are processed on the basis of Art. 6 Abs. 1 lit. f DSGVO, you have the right, under the legal requirements, to object to this processing on grounds relating to your particular situation.
You may object to the processing of personal data for direct marketing purposes at any time.
Withdrawal of consent
You may withdraw consent that has been granted at any time with effect for the future.
The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
23. Exercising your rights
To exercise your data protection rights, you can contact us:
Email: aurimangaka@gmail.com
Postal address:
Elias Harmanus
c/o SP-Day Impressum-Service
Dr. Lutz Kreutzer
Hauptstraße 8
83395 Freilassing
Germany
We may request additional information where this is necessary to verify your identity and protect personal data from unauthorised access.
You will not suffer any disadvantages as a result of exercising your statutory data protection rights.
24. Right to lodge a complaint
Pursuant to Art. 77 DSGVO, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the DSGVO.
In particular, you may contact the data protection supervisory authority of your habitual residence, your place of work or the place of the alleged data protection infringement.
25. Data relating to minors
Our online shop is not specifically aimed at children.
Personal data relating to minors are processed only where permitted under applicable law.
If we become aware that personal data relating to a child or young person have been processed unlawfully, we will take the necessary measures.
Parents or legal guardians can contact us at aurimangaka@gmail.com.
26. Data security
We take appropriate technical and organisational measures to protect personal data against:
-
Loss
-
Manipulation
-
Unauthorised access
-
Unauthorised disclosure
-
Destruction
Despite appropriate security measures, absolute security cannot be guaranteed when transmitting data over the internet.
27. Legally required disclosure
Personal data may be disclosed where we are required to do so by law, regulatory order or court decision.
Disclosure may also take place where this is necessary for the establishment, exercise or defence of legal claims and is legally permitted.
28. Changes to this Privacy Policy
We may update this Privacy Policy if, for example:
-
Our data processing
-
Service providers used
-
Functions of our shop
-
Technical systems
-
Legal requirements
change.
The current version will be published on this website.
The date of the most recent update can be found at the beginning of this Privacy Policy.
29. Contact
If you have any questions about data protection, the processing of your personal data or the exercise of your data protection rights, you can contact us:
Elias Harmanus
Sole proprietor
c/o SP-Day Impressum-Service
Dr. Lutz Kreutzer
Hauptstraße 8
83395 Freilassing
Germany
Email: aurimangaka@gmail.com
The postal address is intended exclusively for receiving letter mail. Please do not send parcels or packages to this address.