Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data includes all data that can be used to identify you personally.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Sinan Askin, Rengershäuserstraße 78, 34132 Kassel, Germany, email: info@elisya.de. The controller for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the "https://" prefix and the padlock icon in your browser bar.

2) Data Collection When Visiting Our Website

When you use our website solely for informational purposes, i.e., when you do not register or otherwise submit information to us, we only collect data that your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

• Our website visited
• Date and time of access
• Amount of data sent in bytes
• Source/referral from which you accessed the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files ex post facto should there be concrete indications of unlawful use.

3) Hosting & Content Delivery Network

Shopify

For the hosting of our website and the display of page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify")

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of our visitors' data and prohibits unauthorized disclosure to third parties.

In the event of data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For the transfer of data to the USA, the provider relies on the European Commission's standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

4) Cookies

To make your visit to our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted when the browser is closed (so-called "session cookies"), while others remain on your end device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of your web browser's cookie settings.

If any of the cookies we use process personal data, the processing is carried out pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the event of given consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually on their acceptance or exclude the acceptance of cookies for certain cases or generally.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contact

When contacting us (e.g., via a contact form or email), personal data is processed solely for the purpose of processing and answering your inquiry and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in answering your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at a contract, Art. 6(1)(b) GDPR is the additional legal basis for the processing. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that no statutory retention obligations prevent this.

6) Comment Function

In the context of the comment function on this website, in addition to your comment, information about the time the comment was created and the commenter name you selected is stored and published on this website. Furthermore, your IP address is stored for security reasons to enable attribution to the author in the event of unlawful comments. Your email address is stored for contacting you if a third party should object to your published content as unlawful.

The legal bases for the storage of your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if they are objected to by third parties as unlawful.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing additional data is voluntary and is used to be able to address you personally. For newsletter distribution, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receive the newsletter by clicking a verification link sent to the provided email address

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. Here, we store your IP address registered by the Internet Service Provider (ISP) as well as the date and time of registration to be able to trace possible misuse of your email address at a later time. The data collected by us when subscribing to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to a further use of data that is legally permitted and about which we inform you in this declaration.

7.2 Klaviyo

The distribution of our email newsletters is carried out via this provider: Klaviyo, 225 Franklin St, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when subscribing to the newsletter to this provider pursuant to Art. 6(1)(f) GDPR, so that this provider can carry out the newsletter distribution on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also carries out a statistical success evaluation of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the content of the newsletter. In doing so, end-device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated, but not merged with other data sets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our visitors and prohibits disclosure to third parties.

For the transfer of data to the USA, the provider relies on the European Commission's standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

8) Data Processing for Order Fulfillment

8.1 Transmission of image files for order fulfillment via upload function

On our website, we offer customers the option to commission the personalization of products by submitting image files via an upload function. The submitted image motif is then used as a template for the personalization of the selected product.

Via the upload form on the website, the customer can immediately submit one or more image files from the storage of the end device used to us via automated, encrypted data transmission. We subsequently collect, store, and use the submitted files exclusively for the production of the personalized product in the sense of the respective product description on our website. If the submitted image files are passed on to special service providers for the production and processing of the order, you will be explicitly informed about this in the following paragraphs. No further disclosure takes place. If the submitted files or digital motifs contain personal data (in particular images of identifiable persons), all the processing operations just mentioned are carried out exclusively for the purpose of processing your online order pursuant to Art. 6(1)(b) GDPR.

After the final processing of the order, the submitted image files will be automatically and completely deleted.

8.2 As far as necessary for contract processing for delivery and payment purposes, the personal data collected by us is passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data you submitted when ordering (name, address, email address) to personally inform you about upcoming updates within the legally prescribed period via a suitable communication channel (e.g., by post or email) pursuant to our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for the purpose of communications about the updates we owe and is processed by us for this purpose only to the extent necessary for the respective information.

For the processing of your order, we also work with the following service provider(s), who assist us wholly or partially in the execution of concluded contracts. Certain personal data is transmitted to these service providers according to the following information.

8.3 To fulfill our contractual obligations to our customers, we work with external shipping partners. We pass on your name as well as your delivery address and, if necessary for delivery, your phone number exclusively for the purposes of goods delivery pursuant to Art. 6(1)(b) GDPR to a shipping partner selected by us.

8.4 Use of payment service providers (payment services)

- Amazon Pay

On this website, one or more online payment methods of the following provider are available: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg

When selecting a payment method of the provider where you pay in advance (e.g., credit card payment), your payment data shared during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on to them pursuant to Art. 6(1)(b) GDPR. In this case, the disclosure of your data is carried out exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.
- Apple Pay
If you decide on the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the "Apple Pay" function of your end device operated with iOS, watchOS, or macOS by charging a payment card stored in "Apple Pay". Apple Pay uses security functions integrated into the hardware and software of your device to protect your transactions. Thus, the release of a payment requires the entry of a code previously set by you as well as verification using the "Face ID" or "Touch ID" function of your end device.
For the purpose of payment processing, the information shared by you during the ordering process along with the information about your order is passed on to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number as well as a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.
If personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.
Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, as well as the indication of whether the transaction was successfully completed. Through anonymization, a personal connection is completely excluded. Apple uses the anonymized data to improve "Apple Pay" and other Apple products and services.
If you use Apple Pay on the iPhone or Apple Watch to complete a purchase you made via Safari on the Mac, the Mac and the authorization device communicate via an encrypted channel on the Apple servers. Apple does not process or store any of this information in a format that can identify you. You can disable the option to use Apple Pay on your Mac in the settings of your iPhone. Go to "Wallet & Apple Pay", and disable "Allow payments on Mac".
Further information on data protection with Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027
- Paypal

On this website, one or more online payment methods of the following provider are available: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

When selecting a payment method of the provider where you pay in advance (e.g., credit card payment), your payment data shared during the ordering process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on to them pursuant to Art. 6(1)(b) GDPR. In this case, the disclosure of your data is carried out exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

When selecting a payment method where the provider pays in advance (e.g., invoice or installment purchase, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, if applicable, data about an alternative payment method).

To safeguard our legitimate interest in determining the creditworthiness of our customers, we forward this data to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provided as well as other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment option you selected can be granted in view of payment and/or default risks.

The credit report may contain probability values (so-called score values). As far as score values are included in the result of the credit report, they have their basis in a scientifically recognized mathematical-statistical procedure. In the calculation of the score values, address data is included, but not exclusively.

You can object to this processing of your data at any time by sending us a message or by objecting to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual payment processing.
- Shopify Payments

On this website, one or more online payment methods of the following provider are available: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method provided by the provider that requires you to pay in advance (e.g. credit card payment), your payment details shared during the ordering process (including name, address, bank and card details, currency and transaction number), as well as information about the contents of your order, will be disclosed to them in accordance with Art. 6(1)(b) GDPR. In this case, your data will be disclosed exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
- SOFORT

One or more online payment methods provided by the following provider are available on this website: SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany

If you select a payment method provided by the provider that requires you to pay in advance (e.g. credit card payment), your payment details shared during the ordering process (including name, address, bank and card details, currency and transaction number), as well as information about the contents of your order, will be disclosed to them in accordance with Art. 6(1)(b) GDPR. In this case, your data will be disclosed exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

9) Online Marketing

Facebook Pixel for creating Custom Audiences with enhanced matching (using a cookie consent tool)

Within our online offer, we use the "Facebook Pixel" service provided by the following provider in enhanced matching mode: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook")

If a user clicks on an advertisement placed by us on Facebook, the URL of our linked page will be appended with a parameter using the "Facebook Pixel". This URL parameter will then be entered into the user's browser via a cookie set by our linked page itself after redirection. Furthermore, this cookie collects specific customer data, such as the email address we collect on our website linked to the Facebook ad during processes such as completing a purchase, signing up for an account, or registering (enhanced matching). The cookie is then read and enables the transmission of the data, including the specific customer data, to Facebook.

We use the "Facebook Pixel" with enhanced matching to make our Facebook advertisements (i.e. Facebook Ads) more effective and to ensure that they match users' interests or exhibit certain characteristics (e.g. interests in certain topics or products determined based on the websites visited), which we transmit to Facebook (i.e. "Custom Audiences").

Furthermore, we analyze the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking on an advertisement (conversion). Compared to the standard version of the "Facebook Pixel", the enhanced matching function helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data will be stored and processed by Facebook so that it can be attributed to the respective user profile and Facebook can use the data for its own advertising purposes. The data may enable Facebook and its partners to place advertisements on and off Facebook.

All processing described above, in particular the setting of cookies to read information on the device used, will only take place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our visitors' data and prohibits unauthorized disclosure to third parties.

The information generated by Facebook is generally transmitted to and stored on a Facebook server; in this context, it may also be transmitted to Meta Platforms Inc. servers in the USA.

For the transmission of data to the USA, the provider relies on the European Commission's standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

10) Retargeting/Remarketing and Conversion Tracking

- TikTok Pixel

This website uses the conversion tracking technology provided by the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

If you arrived at our website from an advertisement on the provider's domain, the success of the advertisement can be traced using cookies and/or similar technologies (tracking pixels, web beacons, pings or HTTP requests).

To this end, certain device and browser information, including your IP address if applicable, will be read using the tracking technology to capture and analyze predefined user actions by us (e.g. completed transactions, leads, searches on the website, views of product pages). This enables the creation of statistics on user behavior on our website after being redirected from an advertisement, which serve to optimize our offer.
All processing described above, in particular the setting of cookies to read information on the device used, will only take place if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of our visitors' data and prohibits unauthorized disclosure to third parties.

11) Website Functionality

Endereco

To enable real-time checking of certain inputs in the address form of our webshop's ordering process for input errors, we use the services of the following provider: Endereco UG, Balthasar-Neumann-Straße 4b, 97236 Randersacker, Germany

The provider validates the entered address, verifies the spelling, and supplements any missing data if necessary. For ambiguous addresses, correct alternative suggestions are displayed. For this purpose, the address data you enter will be transmitted to the provider, stored there, and evaluated.

This processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in properly capturing the customer's correct address data to conscientiously fulfill our contractual delivery obligations and to prevent problems with contract performance.

The provider processes the affected data separately and does not combine it with other data sets, and deletes it as soon as its status or correctness has been confirmed, but no later than 30 days.

12) Data Subject Rights

12.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller regarding the processing of your personal data, whereby the respective requirements for exercising them are referred to in the stated legal basis:

• Right of access in accordance with Art. 15 GDPR;
• Right to rectification in accordance with Art. 16 GDPR;
• Right to erasure in accordance with Art. 17 GDPR;
• Right to restriction of processing in accordance with Art. 18 GDPR;
• Right to be informed in accordance with Art. 19 GDPR;
• Right to data portability in accordance with Art. 20 GDPR;
• Right to withdraw consent in accordance with Art. 7(3) GDPR;
• Right to lodge a complaint in accordance with Art. 77 GDPR.

12.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTERESTS AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING FOR GROUNDS ARISING FROM YOUR PARTICULAR SITUATION WITH FUTURE EFFECT.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE AFFECTED DATA. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU CAN EXERCISE THIS RIGHT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE AFFECTED DATA FOR DIRECT MARKETING PURPOSES.

13) Duration of Storage of Personal Data

The duration for which personal data is stored is determined by the respective legal basis, the purpose of processing, and – where applicable – additionally by the respective statutory retention period (e.g. commercial and tax retention periods).

When personal data is processed on the basis of express consent in accordance with Art. 6(1)(a) GDPR, the affected data will be stored until you withdraw your consent.

If statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods expire, provided it is no longer required for the fulfillment or pre-contractual performance of the contract and/or we no longer have a legitimate interest in continued storage.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this notice regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.