Privacy policy

Unless otherwise specified below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obligated to provide the data. Non-provision has no consequences. This only applies unless otherwise specified in the subsequent processing operations. "Personal data" means any information relating to an identified or identifiable natural person.

You can visit our websites without providing personal information. Every time our website is accessed, usage data is transmitted to us or our web host / IT service provider by your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, date and time of access, IP address, volume of data transferred, and the requesting provider. Processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offer. Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. An adequacy decision by the European Commission exists for Canada. An adequacy decision by the European Commission exists for the USA (EU-U.S. Data Privacy Framework / DPF). Where data is transferred to the USA or third countries, this is additionally safeguarded by standard contractual clauses of the European Commission.

Data Controller: If you wish to contact us, the controller for data processing is: mizaru GmbH, Lerchenfeldstraße 47, 79199 Kirchzarten, Germany, Email: shop@mizaru.de, Website: www.mizaru.de.

Initiating Contact by Customer via Email: When you initiate business contact with us via email, we collect your personal data (name, email address, message text) only to the extent provided by you. Data processing serves to process and answer your contact inquiry.

If the contact serves the execution of pre-contractual measures (e.g., consultation for purchase interest, creation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) lit. b GDPR.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in processing and answering your inquiry. In this case, you have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you based on Art. 6 (1) lit. f GDPR.

We use your email address only to process your inquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing when Using the Contact Form: When using the contact form, we collect your personal data (name, email address, message text) only to the extent provided by you. Data processing serves the purpose of contacting you.

If the contact serves the implementation of pre-contractual measures or concerns a contract already concluded, processing is carried out on the basis of Art. 6 (1) lit. b GDPR. If contact is made for other reasons, it is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in processing and answering your inquiry; you have the right to object at any time for reasons arising from your particular situation.

Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing.

Customer Account: When opening a customer account, we collect your personal data to the extent specified therein. Data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the lawfulness of processing carried out based on the consent until revocation. Your customer account will then be deleted.

Collection, Processing, and Transfer of Personal Data for Orders: When placing an order, we collect and process your personal data only to the extent necessary for the fulfillment and processing of your order as well as for handling your inquiries. The provision of data is required for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is carried out on the basis of Art. 6 (1) lit. b GDPR.

Your data is passed on, for example, to shipping companies (e.g., DHL), payment service providers, service providers for order processing, and IT service providers. In all cases, we strictly observe legal requirements. The scope of data transmission is limited to a minimum.

Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. An adequacy decision by the European Commission exists for Canada. An adequacy decision by the European Commission exists for the USA (EU-U.S. Data Privacy Framework). This data transfer is additionally safeguarded by contractual obligations based on the standard contractual clauses of the European Commission.

During payment processing, we pass on the necessary data to the respective selected payment service provider, insofar as this is necessary for the payment processing. This serves the fulfillment of the contract pursuant to Art. 6 (1) lit. b GDPR. In some cases, payment service providers collect the required data themselves; in this respect, their privacy policy applies.

Shopify Payments (Credit Card, Apple Pay, Google Pay, EPS): For processing payments by credit card (Visa, Mastercard, American Express), Apple Pay, Google Pay, and EPS, we use Shopify Payments, a service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify"). Shopify International Limited is an affiliated company of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada). The data required for the payment is transmitted to Shopify or the respective payment processor. Your data may be transferred to third countries outside the EU, in particular to Canada and the USA. An adequacy decision by the European Commission exists for Canada; an adequacy decision exists for the USA (EU-U.S. Data Privacy Framework). Additionally, the transfer is based on standard contractual clauses of the European Commission. Further information: https://www.shopify.com/legal/privacy.

PayPal: When selecting the payment method PayPal, the data required for payment processing is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal may transmit data to credit agencies for identity and credit checks. Further information: https://www.paypal.com/webapps/mpp/ua/privacy-full.

Klarna: When selecting a payment method offered by Klarna, the data required for payment processing is transmitted to Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may transmit data to credit agencies for identity and credit checks. Further information: https://www.klarna.com/privacy/.

Use of Email Address for Sending Newsletters: Independently of contract fulfillment, we use your email address exclusively for our own advertising purposes for sending mizaru® newsletters, provided you have given your explicit consent. Registration takes place via a double opt-in procedure. Processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You can revoke your consent at any time without affecting the lawfulness of processing carried out based on the consent until revocation. You can unsubscribe from the newsletter at any time via the corresponding link in the newsletter or by notifying us; your email address will then be removed from the distribution list.

Use of Shopify Email: We use the Shopify Email service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") to send our newsletters and promotional emails. Shopify processes your data (in particular email address, IP address, and evaluation data regarding interaction with the emails) on our behalf.

To evaluate the success of our email campaigns, the emails contain standard web beacons or tracking links. This allows us to determine whether a message was opened and which links were clicked. Processing is carried out based on your consent (Art. 6 (1) lit. a GDPR). Your data may be transmitted to servers of Shopify Inc. in Canada and the USA. An adequacy decision by the European Commission exists for Canada; for the USA, data transmission is secured via the EU-U.S. Data Privacy Framework (DPF) and standard contractual clauses. Further information: https://www.shopify.com/legal/privacy.

Our website uses cookies. Cookies are small text files stored in the internet browser or by the internet browser on a user's computer system that enable the browser to be recognized.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By adjusting the technical settings in your internet browser accordingly, you can be notified before cookies are set, decide on acceptance individually, and prevent the storage and transmission of the data contained therein. Cookies already stored can be deleted at any time. Please note that you may then not be able to use all functions of this website to their full extent.

Information on managing cookies in major browsers:

• Chrome: https://support.google.com/accounts/answer/61416?hl=de

• Microsoft Edge: https://support.microsoft.com/microsoft-edge

• Mozilla Firefox: https://support.mozilla.org/kb/enable-and-disable-cookies-website-preferences

• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically Necessary Cookies: Unless otherwise specified below, we only use technically necessary cookies to make our offer more user-friendly, effective, and secure. Use is based on § 25 para. 2 TDDDG (Telecommunications Digital Services Data Protection Act). The processing of your personal data is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer. You have the right to object at any time for reasons arising from your particular situation.

Use of the Shopify Consent Tool (Shopify Privacy & Compliance): We use the consent tool "Shopify Privacy & Compliance" from Shopify International Ltd. (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. Shopify is an affiliated company of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The tool allows you to grant consent to data processing via the website, in particular the setting of cookies, and to exercise your right of revocation for consent already given. Data processing serves the purpose of obtaining and documenting required consents and thus complying with legal obligations. Cookies may be used for this purpose. User information including your IP address is collected and transmitted to Shopify. Your data may be transferred to third countries outside the EU, in particular to Canada and the USA (adequacy decisions / EU-U.S. Data Privacy Framework in place, as well as safeguarding via standard contractual clauses).

Data processing is carried out to fulfill a legal obligation based on Art. 6 (1) lit. c GDPR. Further information: https://www.shopify.com/legal/privacy and https://www.shopify.com/legal/cookies.

Advertising Tracking and Analysis (All subsequent services are loaded only after your explicit consent via our consent tool.)

Meta Pixel: We use the Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "Meta") on our website. Meta and we are joint controllers for the collection and transmission of this data to Meta; the basis is a joint processing agreement (https://www.facebook.com/legal/terms/businesstools).

The application serves to target website visitors with interest-based advertising within the Facebook and Instagram networks and to create conversion statistics. Your data may be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework (DPF). Processing is carried out with your consent based on § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. You can revoke your consent at any time. Further information: https://www.facebook.com/about/privacy/.

Google Ads Conversion Tracking: We use the online advertising program "Google Ads" and, within this framework, conversion tracking from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). If you click on an ad placed by Google, a conversion cookie is set. The information obtained in this way is used to create conversion statistics; we do not receive any information that personally identifies users. Your data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework (DPF). Use is based on your consent pursuant to § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. You can revoke your consent at any time via our consent tool. Further information: https://policies.google.com/privacy.

Google Tag Manager: We use Google Tag Manager from Google Ireland Limited. JavaScript and HTML tags are managed with this. Google Tag Manager itself does not store cookies and does not process personal data, but it enables the triggering of other tags that may collect personal data.

Google reCAPTCHA: We use the reCAPTCHA service from Google Ireland Limited to distinguish between human and automated input. Your input, IP address, and any other data required are transmitted to Google and may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework (DPF). Use is based on your consent pursuant to § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. Further information: https://policies.google.com/privacy.

Google Maps: We use the embedded Google Maps function of Google Ireland Limited to display geographical information. Data of visitors is also collected and may be transmitted to the USA; Google is certified under the EU-U.S. Data Privacy Framework (DPF). Use is based on your consent pursuant to § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. Further information: https://policies.google.com/privacy.

YouTube: We use the embedded YouTube video function of Google Ireland Limited. "Enhanced privacy mode" is enabled; information is only transmitted to YouTube and potentially transferred to the USA when you watch a video; Google/YouTube is certified under the EU-U.S. Data Privacy Framework (DPF). Use is based on your consent pursuant to § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. Further information: https://policies.google.com/privacy.

Duration of Storage: After complete contract execution, the data is initially stored for the duration of the warranty period, then taking into account statutory, especially tax and commercial retention periods, and deleted after the expiration of the period unless you have consented to further processing. Rights of the Data Subject: Under the statutory requirements, you have the following rights pursuant to Art. 15 to 20 GDPR:

• Right of access

• Right to rectification

• Right to erasure

• Right to restriction of processing

• Right to data portability

Furthermore, pursuant to Art. 21 (1) GDPR, you have the right to object to processing based on Art. 6 (1) lit. f GDPR, as well as to processing for direct marketing purposes.

Right to Lodge a Complaint with a Supervisory Authority: Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful. You can lodge a complaint with the supervisory authority responsible for us, among others:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Heilbronner Straße 35

70191 Stuttgart

Postfach 10 29 32

70025 Stuttgart

Phone: +49 711 615541-0

Fax: +49 711 615541-15

Email: poststelle@lfdi.bwl.de

Right to Object: If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right to object to these processing operations at any time for reasons arising from your particular situation, with effect for the future.

After an objection is made, the processing of the affected data will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

Date of Privacy Policy: August 2026