Privacy policy
Privacy Policy
Last updated: 20 October 2026
1. Controller
The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Hair Pro Shop, sole proprietor Andrii Chernyshuk
Putzbrunner Straße 10, 85521 Ottobrunn, Germany
Email: hairproeu@gmail.com — Phone: +49 175 6296979
VAT ID: DE354396739
We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG.
2. General information
We process personal data only where there is a legal basis for doing so, and only to the extent necessary for the stated purpose. Personal data means any information relating to an identified or identifiable natural person.
Our website is hosted on the Shopify platform. Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.
3. Data we process when you visit the website
When you access our website, your browser automatically transmits technical data which is stored in server log files:
- IP address (shortened or anonymised where possible)
- Date and time of access
- Pages requested and volume of data transferred
- Browser type and version, operating system
- Referring URL
Purpose: delivering the website, ensuring stability and security, detecting and preventing attacks.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure and functional website.
Retention: log data is deleted after no more than 30 days unless required longer to investigate a specific security incident.
4. Data we process when you place an order
To process your order we collect:
- First and last name
- Billing and delivery address
- Email address and, where provided, telephone number
- Order details and order history
- Payment data (processed by the payment provider; we do not store full card numbers)
- VAT identification number, where you order as a business
Purpose: performance of the purchase contract, delivery, invoicing, customer service, handling of returns and warranty claims.
Legal basis: Art. 6 (1) (b) GDPR — performance of a contract; Art. 6 (1) (c) GDPR — compliance with tax and commercial law obligations.
Retention: order and invoice data is retained for 10 yearsunder § 147 AO and § 257 HGB. After the contract has been performed the data is restricted from further processing and used only to meet those retention obligations.
5. Recipients of your data
We pass your data on only where necessary and only to the following categories of recipients:
| Recipient | Purpose | Data transferred |
|---|---|---|
| Shopify International Ltd., Ireland | Shop platform, hosting, checkout | All order and account data |
| DHL (Deutsche Post DHL Group), Germany | Delivery of parcels | Name, delivery address, email or phone for delivery notifications |
| UPS, where express delivery is selected | Delivery of parcels | Name, delivery address, contact details |
| Amazon (fulfilment, USA) | Delivery of US orders from our US warehouse | Name, delivery address, order contents |
| Payment service providers (shown at checkout) | Payment processing, fraud prevention | Name, payment data, order amount |
| Tax advisor, ETL Kramer & Kollegen GmbH | Bookkeeping and tax filings | Invoice data |
| Customs authorities | Export and import declarations for non-EU orders | Name, address, contents and value of the parcel |
Our service providers act as processors under Art. 28 GDPR or, where they determine their own purposes (carriers, payment providers), as independent controllers.
6. Transfers to third countries
Where we ship outside the European Economic Area, your delivery data is necessarily transferred to the destination country and its customs authorities. This transfer is based on Art. 49 (1) (b) GDPR, as it is necessary for the performance of the contract you have entered into.
Transfers to processors in third countries, including Amazon in the United States, take place on the basis of the European Commission's Standard Contractual Clauses together with supplementary technical and organisational measures, or on the basis of an adequacy decision where one applies.
7. Customer account
You may create a customer account. The data you store there is used to let you view your orders and manage your addresses.
Legal basis: Art. 6 (1) (b) GDPR.
Retention: until you delete your account. Statutory retention periods for order data remain unaffected.
8. Contact by email
If you contact us by email, we process the data you provide in order to answer your enquiry.
Legal basis: Art. 6 (1) (b) GDPR where the enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in responding to enquiries.
Retention: enquiries are deleted once they have been dealt with conclusively and no retention obligation applies.
9. Newsletter
If you subscribe to our newsletter, we use your email address to send product information and offers. Subscription uses the double opt-in procedure: you will receive a confirmation email and are only added to the list once you confirm.
Legal basis: Art. 6 (1) (a) GDPR — your consent. You may withdraw your consent at any time with effect for the future, using the unsubscribe link in every newsletter or by emailing us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We log the time of subscription and confirmation in order to demonstrate compliance; this log is retained for the duration of the subscription and for three years thereafter.
10. Cookies and tracking
We use cookies on our website. Technically necessary cookies (session, cart, security, language and currency settings) are required for the shop to function.
Legal basis for necessary cookies: § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.
Cookies and similar technologies used for analysis, marketing or personalised advertising are set only with your prior consent via our cookie banner.
Legal basis: § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You may change or withdraw your choice at any time through the cookie settings on our website.
You can also configure your browser to block or delete cookies. Blocking necessary cookies may prevent parts of the shop from working.
Our website recognises the Global Privacy Control (GPC) signal and treats it as a valid objection to the sharing of data for targeted advertising.
11. Social media and advertising
Where we use advertising or measurement tools of third-party providers such as Meta Platforms or Google, these are activated only after you have given consent through the cookie banner. In that case data such as your IP address, browsing behaviour on our site and information about purchases may be transferred to the respective provider, including to the United States.
Legal basis: Art. 6 (1) (a) GDPR — your consent, which you may withdraw at any time with effect for the future.
12. Your rights
You have the following rights in respect of your personal data:
- Access (Art. 15 GDPR) — to obtain confirmation whether we process your data and a copy of it.
- Rectification (Art. 16 GDPR) — to have inaccurate data corrected.
- Erasure (Art. 17 GDPR) — to have your data deleted, unless a retention obligation applies.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used, machine-readable format.
- Objection (Art. 21 GDPR) — to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR. Where data is processed for direct marketing, you may object at any time without giving reasons.
- Withdrawal of consent (Art. 7 (3) GDPR) — at any time with effect for the future.
To exercise any of these rights, write to hairproeu@gmail.com. We will respond within one month.
13. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de
14. Obligation to provide data
You are not legally obliged to provide us with personal data. However, we cannot conclude or perform a purchase contract without the data marked as mandatory at checkout.
15. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
16. Security
Our website uses TLS encryption to protect data transmitted between your browser and our servers. We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. No security measure is absolute; we recommend you do not send sensitive information through unsecured channels.
17. Children
Our services are not directed at children. We do not knowingly collect data from persons under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
18. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our processing activities or legal requirements. The current version is always available on this page.