Privacy Policy (GDPR)

This page is placeholder content for demonstration purposes. The sections below were written solely to demonstrate the layout of this shop; they are not legal advice and do not create rights or obligations of any kind.

Before the shop goes live, this text must be reviewed and replaced by a Rechtsanwalt or solicitor qualified in Germany, in particular as regards the provider information required by § 5 TMG and the privacy information required by Article 13 GDPR.

Every item in square brackets is still open. Until that review is complete, those items must not be read as binding company, register or tax details.

The controller within the meaning of Article 4(7) GDPR is YOUMI Asia Market (Demo), [Insert street and number], [Insert postcode] Berlin, Germany. Email: [Insert email address]; telephone: [Insert telephone number].

No data protection officer has been appointed for this demonstration. Where appointment is required under § 38 BDSG, the name and contact details will be added here: [Insert data protection officer].

We process personal data that you provide when using the shop, placing an order or making an enquiry. In detail:

• —Account data: name, email address, password in hashed form, time of registration.
• —Order and delivery data: billing and delivery address, telephone number used for delivery, order items, returns.
• —Payment data: chosen payment method, payment status, transaction reference; full card details are not stored by us.
• —Communication data: the content of enquiries made by form, email or telephone.
• —Technical data: IP address, date and time of access, pages requested, browser type and operating system.
• —Consent data: newsletter subscription, cookie settings, and when and to what extent consent was given.

We process personal data only where a legal basis under Article 6(1) GDPR exists. The mapping is as follows:

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR. Consent you have given may be withdrawn at any time with effect for the future.

• —Article 6(1)(b) GDPR (performance of a contract): account, order handling, delivery, payment processing, returns and refunds.
• —Article 6(1)(c) GDPR (legal obligation): retention of invoices and accounting records under § 147 AO and § 257 HGB; handling defect claims.
• —Article 6(1)(f) GDPR (legitimate interests): IT security, prevention of abuse and fraud, and the establishment and defence of legal claims.
• —Article 6(1)(a) GDPR (consent): newsletter and optional analytics and marketing cookies.

Processors acting on our behalf are bound by data processing agreements under Article 28 GDPR and may use the data only on our instructions. Transfers to third countries take place only where the requirements of Articles 44 et seq. GDPR are met, for example on the basis of standard contractual clauses or an adequacy decision. We do not sell personal data.

We otherwise share personal data only where this is necessary to perform the contract, required by law, or covered by your consent. Recipients include in particular:

• —Stripe Payments Europe, Ltd. – payment processing and fraud prevention.
• —DHL Paket GmbH – delivery; name, address, telephone number where applicable, and shipment data are transmitted.
• —Email service provider [Insert provider] – order confirmations, dispatch notifications and newsletters.
• —Hosting provider [Insert hosting provider] – operation of the website and databases in data centres within the European Union.

We use strictly necessary cookies, for the basket, sign-in and language setting, on the basis of § 25(2) TDDDG and Article 6(1)(f) GDPR. Optional analytics and marketing cookies are set only after consent under § 25(1) TDDDG, which may be withdrawn at any time through the cookie settings.

• —Account data: for as long as the account exists, then deleted within 30 days.
• —Order and invoice data: ten years, on the basis of commercial and tax retention obligations.
• —Server log files: [Insert retention period for log files], normally no longer than seven days.
• —Newsletter data: until consent is withdrawn.
• —Cookies: no longer than [Insert cookie retention period].

Under the GDPR you have in particular the following rights against the controller:

Please address requests to [Insert email address]. We reply without undue delay and in any event within one month of receipt (Article 12(3) GDPR).

• —Access to the data processed (Article 15 GDPR).
• —Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
• —Erasure, where no retention obligation prevents it (Article 17 GDPR).
• —Restriction of processing (Article 18 GDPR).
• —Data portability in a structured, commonly used and machine-readable format (Article 20 GDPR).
• —Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).
• —Withdrawal of consent with effect for the future (Article 7(3) GDPR).

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence or with the authority responsible for us:

Berliner Beauftragte für Datenschutz und Informationsfreiheit, [Insert address], Berlin. Contact and complaint details are published on the authority's website. The right to complain also exists in respect of other supervisory authorities.

The website is served exclusively over an encrypted connection (TLS). Passwords are stored using a salted hash, access is role-based and logged, and card data is tokenised at Stripe; card verification values are not stored by us.

We back up data regularly and review our technical and organisational measures under Article 32 GDPR as required. Absolute protection of personal data is not technically possible; in the event of a breach posing a high risk, we notify affected individuals and the supervisory authority in accordance with Articles 33 and 34 GDPR.