Datenschutzerklärung

 

1. Scope and Privacy Contact

This proposed policy concerns personal information associated with browsing, purchasing from, or contacting ever-prettya.shop. Privacy enquiries may be directed to info@ever-prettya.shop. The domain and email do not substitute for the legal identity and contact details of the data controller.

2. Information to Be Covered

The final policy should describe the information actually handled at each stage of a customer's interaction with the store. Relevant categories to verify include customer names, email addresses, delivery and billing details, order contents, payment status, account information, and correspondence about deliveries or returns.

Technical information must also be checked against the store's configuration, including whether server logs, device identifiers, IP addresses, consent records, or browsing events are collected. This draft does not confirm that all of these categories are collected, or that any particular analytics or advertising system is active.

3. Purposes and Legal Bases

Each actual purpose requires an appropriate GDPR legal basis. The final notice must distinguish order fulfilment and requested pre-contract steps, legal recordkeeping, justified security or claims-related interests, and processing based on consent. Any legitimate interests relied on must be identified rather than described only as a general business need.

4. Store Platform and Other Recipients

Before publication, the merchant must verify its platform arrangements and any payment, delivery, hosting, support, accounting, or marketing providers. The completed notice must identify recipients or meaningful recipient categories and explain their roles. Use of Shopify or any other provider must be described according to the services actually enabled.

The merchant should check which information a fulfilment partner receives, which party handles card details, and whether an optional application has access to customer records. Installing an application can change the disclosures required; this draft does not certify any application or provider arrangement.

5. Cookies and Similar Technologies

Under German terminal-device rules, storing or accessing information on a user's device generally requires informed consent unless a statutory exception applies, such as strict necessity for a service expressly requested by the user. Analytics and advertising technologies must not be assumed to qualify for that exception.

The final implementation must match its cookie and consent disclosures. The merchant must verify the actual tools, purposes, providers and durations, and supply a usable method to revise consent. This policy text does not itself create a consent banner or block tracking scripts.

6. Marketing Preferences

Whether the store sends newsletters, uses advertising audiences, or performs marketing profiling remains unconfirmed. The published notice must accurately describe any such activity and its applicable legal basis and controls. A statement about an unsubscribe link must not be published unless that mechanism is actually available.

7. Transfers and Retention

Where information is transferred outside the EEA, the final notice must explain the applicable safeguards or other lawful transfer mechanism. Retention periods, or meaningful criteria for deciding them, must be specified for actual records. This draft does not establish a fixed retention schedule or confirm that any provider's location or certification makes a transfer lawful.

8. Individual Rights

Depending on the legal conditions, individuals may request access, correction, erasure, restriction, portability, or object to processing. Consent can be withdrawn without affecting earlier lawful processing. Individuals can complain to a competent supervisory authority. The merchant must establish a process for responding within applicable legal deadlines and requesting only proportionate identity verification.

9. Security and Enquiries

Do not send account passwords, full payment-card details, or unnecessary identity documents to the support inbox. If an enquiry requires identity verification, the requested information and transmission method should be proportionate to the request. No assertion that a specific encryption, audit, certification, or fraud-control system is in operation has been verified for this draft.

10. Completing and Updating This Notice

The merchant must confirm whether a data protection officer or representative is required and add the relevant details where applicable. Any automated decisions with legal or similarly significant effects must also be assessed. The published version should be reviewed whenever the underlying processing changes.

11. Information Provided in Customer Correspondence

Customer messages may contain more information than an order record, such as photographs of a damaged item or an explanation of a delivery problem. Before publication, the merchant should establish how such correspondence is stored, who can access it, and when it is removed. The final notice must reflect those arrangements rather than imply that every message is automatically deleted when an enquiry closes.

Customers should keep messages focused on the issue being raised and avoid including information about unrelated people. If a photograph is useful, check whether it unnecessarily reveals an address label, another person's image, or sensitive material in the background. This is practical guidance to reduce unnecessary disclosure, not a condition for making a legitimate complaint.

12. Required and Optional Information

The store's actual forms need to distinguish information required for the requested service from optional information. For example, an address needed to deliver a purchase should not be confused with permission to send promotional messages. The final policy must describe the actual consequences of not providing required data without claiming that every field in every form is compulsory.

The merchant must verify whether account creation is optional, whether a telephone number is genuinely required by the delivery arrangement, and what an optional preference field is used for. Those matters cannot be established from the domain name. The completed privacy explanation must follow the actual checkout and account experience.

13. Privacy Requests and Order Support

When writing to info@ever-prettya.shop about privacy, explain whether you are asking a question, seeking a copy of information, requesting a correction, or raising another concern. Do not send identity documents unless a proportionate verification process has been explained. The support process must distinguish a privacy request from an ordinary product-return request so that neither is overlooked.

The merchant should maintain an internal method for locating relevant records across the services actually used by the store. A request must not be considered resolved merely because information was changed in one system while relevant copies remain elsewhere. The final response and any retained records of the request must be handled according to applicable requirements.

14. Optional Features and External Pages

Reviews, wish lists, chat tools, social-media embeds, and newsletter forms can introduce additional processing. This draft does not confirm that these features are enabled. Before adding one, the merchant must determine what information it receives, whether information is made public, and whether the published explanation and consent controls require changes.

If the store links to another website, customers should be able to recognise when they are leaving the store. An external site's privacy notice may describe that site's independent activities, but linking to it does not by itself explain information sent by an embedded tool before a visitor chooses to leave.

15. Maintaining an Accurate Published Policy

A completed notice should be checked against the applications installed, the settings actually selected, the contracts with providers, and the procedures followed by staff. A generic statement that information may be used for any business purpose is not an adequate substitute for that work. Claims about selling information, profiling, storage locations, or the absence of tracking must be made only after verification.

This expanded draft therefore preserves the distinction between proposed policy structure and verified processing facts. The merchant's legal identity, actual providers, retention details, and enabled features remain necessary to convert it into a customer-facing final privacy notice.