Privacy policy
Last updated: [DATE]
This policy explains what personal data we collect when you visit doviejewelry.com or buy from us, why we collect it, who we share it with, and what rights you have. It's written in plain language. If anything is unclear, email us at [EMAIL].
1. Who is responsible (controller)
[NAME], trading as DOVIE [ADDRESS], Germany Email: [EMAIL] (Full details: see our Legal Notice.)
We're a one-person business and aren't legally required to appoint a data protection officer.
2. Summary
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Order data (name, addresses, email, phone if given, items, payment status) | To process and deliver your order and handle returns | Art. 6(1)(b): contract |
| Invoices and accounting records | Tax and commercial law | Art. 6(1)(c): legal obligation |
| Technical data needed to run the shop (IP address, device, essential cookies) | Security, cart, checkout | Art. 6(1)(f): legitimate interest; §25(2) TDDDG (strictly necessary) |
| Analytics and marketing cookies or pixels | Measure and improve the shop, ads reporting | Art. 6(1)(a) + §25(1) TDDDG: your consent |
| Newsletter | Send offers and gift reminders | Art. 6(1)(a): your consent |
| Review requests | Ask for a review after your purchase | Art. 6(1)(f): legitimate interest (you can object any time) |
| Customer messages | Answer your questions | Art. 6(1)(b) or (f) |
3. Visiting the website: hosting by Shopify
Our shop runs on Shopify. For customers and merchants in the EU, the contracting entity is Shopify International Limited, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes data on our behalf under a data processing agreement (Art. 28 GDPR).
When you visit the shop, Shopify automatically processes technical data such as your IP address, browser type, device, pages visited, referrer and time of access, so the site works, stays secure and loads quickly. Shopify may process data in Canada (the EU recognises Canada as offering adequate protection) and in the USA and other countries, protected by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. More: https://www.shopify.com/legal/privacy
4. Cookies and similar technologies
We use a cookie banner (Shopify Customer Privacy). It shows to visitors from the EEA and the UK. - Strictly necessary cookies (cart, checkout, security, saving your cookie choice) work without consent (§25(2) TDDDG). - Analytics, preferences and marketing cookies and pixels are set only if you click "Accept" or allow them under "Manage". You can change or withdraw your choice any time via "Cookie settings" in the footer. Cookie lifetimes range from the session to up to [24] months, depending on the cookie.
5. Placing an order
To process your order we need your name, email, shipping and billing address, the items ordered and payment status. Your phone number is optional (it can help with delivery). Mandatory fields are marked.
Fulfilment (dropshipping): We don't hold stock. Your order is sent from our fulfilment partner's warehouse in China. To ship it, we pass your name, shipping address, phone (if given) and the ordered items to our fulfilment partner: - TeemDrop [SUPPLIER LEGAL ENTITY NAME AND ADDRESS] Data may be processed in China, protected by the EU Standard Contractual Clauses.
Shipping carriers: The warehouse hands your name, address and (if needed) email or phone to the carrier delivering your parcel (e.g. [PostNord, An Post, PostNL, DHL, GLS, DPD, Royal Mail, Evri]) for delivery and tracking notifications.
6. Payments
We don't see or store your full card details. Payments are processed by: - Shopify Payments (card payments, Apple Pay, Google Pay, iDEAL | Wero, MobilePay, Swish and others). Shopify Payments is operated with Stripe as payment processor. The providers receive the payment data, order amount, and name and address needed for fraud checks. More: https://www.shopify.com/legal/privacy and https://stripe.com/privacy - PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, if you choose PayPal. More: https://www.paypal.com/privacy - Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, if you choose Klarna. Klarna may run an identity and credit check, as its own controller. More: https://www.klarna.com/privacy
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) (fraud prevention).
7. Customer account (optional)
If you create an account, we store your details and order history until you delete the account. You can also check out as a guest.
8. Newsletter (Shopify Email)
If you sign up, we send you emails about new pieces, offers and gift reminders using Shopify Email (provided by Shopify, see section 3). - We use double opt-in: you confirm your subscription with a link in an email. We record the signup and confirmation time and IP address as proof. - You can unsubscribe any time with the link in every email or by writing to [EMAIL]. - We measure whether emails are opened and links clicked, to improve them. You can avoid this by unsubscribing [or by blocking images]. - Abandoned cart reminders: if you start checkout and don't finish, we may send one reminder [only if you've subscribed / owner to decide]. - Existing customers: we may email you about similar products after a purchase under §7(3) UWG. You can object any time, free of charge, and we tell you so at checkout and in every email. Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) / §7(3) UWG for existing customers.
9. Reviews (Judge.me)
We use Judge.me to collect and display product reviews. After your order is delivered we send one review request email (and possibly one reminder) with your name, email and the products ordered. If you write a review, your name (as you choose to show it, e.g. "Anna K."), review text, rating, any photos, and a "verified buyer" badge are published. Provider: [Judge.me legal entity and address — check https://judge.me/privacy]. Data may be processed outside the EU, protected by the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR. You can object to review emails any time (link in the email or email us), and ask us to delete a review.
10. Analytics
- Shopify Analytics: Shopify measures visits and sales for us. Non-essential tracking runs only with your consent.
- [OPTIONAL — delete if not used] Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) only with your consent. Data may be transferred to the USA (EU–US Data Privacy Framework).
- [OPTIONAL — delete if not used] Meta Pixel (Meta Platforms Ireland Ltd.), TikTok Pixel (TikTok Technology Limited, Ireland), Pinterest Tag (Pinterest Europe Ltd., Ireland) only with your consent, to measure our social media and ad performance. We and the platform may be joint controllers (Art. 26 GDPR) for collecting the data.
11. Social media profiles
We have profiles on TikTok, Instagram and Pinterest. When you visit them, those platforms process your data under their own privacy policies. Our website only links to them. Nothing is loaded from those platforms until you click a link.
12. Contacting us
If you email us or use the contact form, we use your details to answer you (Art. 6(1)(b) or (f) GDPR). Our mailbox is provided by [EMAIL PROVIDER, e.g. Google Workspace / Zoho / your registrar].
13. How long we keep data
- Order and invoice data: 8 years for accounting records and 10 years for books and annual statements (German tax and commercial law, §147 AO, §257 HGB). After that, it's deleted.
- Customer messages: up to 3 years after the matter is closed (limitation period), unless the law requires longer.
- Newsletter: until you unsubscribe. Proof of consent is kept up to 3 years after that.
- Cookies: as described in the cookie banner.
14. Your rights
You have the right to: - access your data (Art. 15 GDPR), - correct it (Art. 16), - have it deleted (Art. 17), - restrict its processing (Art. 18), - receive it in a portable format (data portability, Art. 20), - withdraw consent at any time for the future (Art. 7(3)), - object to processing based on legitimate interest, and always to direct marketing (Art. 21).
Just email [EMAIL].
Right to complain: You can complain to any data protection supervisory authority, for example the one in your country, or ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de (Ireland: Data Protection Commission, www.dataprotection.ie · Netherlands: Autoriteit Persoonsgegevens · Sweden: IMY · Denmark: Datatilsynet · Finland: Tietosuojavaltuutetun toimisto · UK: ICO, ico.org.uk.)
15. UK customers
For UK customers, the UK GDPR and the Data Protection Act 2018 also apply. Your rights are the same as above. You can complain to the ICO.
16. Changes
We update this policy when our services or the law change. The current version is always on this page.