Privacy Policy

The protection of your personal data is important to us. In this privacy policy, we inform you about what personal data we process, for what purposes and on what legal basis this happens, to whom we disclose data, and what rights you have.

1. Controller

The controller responsible for the processing of personal data on this website and in connection with our online shop, in the sense of the General Data Protection Regulation (GDPR), is:

Bold & Boundless LLC
1007 N Orange St., 4th Floor, Suite #3063
Wilmington, Delaware 19801
United States
Email: support@shinorabeauty.com

For all questions regarding data protection and the exercise of your rights, you can contact us at any time at support@shinorabeauty.com.

2. Scope and Definitions

This privacy policy applies to our online shop at www.shinorabeauty.de as well as to all associated offers, functions, and communication channels.

Personal data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes, for example, your name, address, email address, order data, and IP address.

3. Legal Bases for Processing

We process personal data based on the following regulations:

Art. 6 para. 1 lit. a GDPR (Consent) – if you have given us explicit consent, for example, for receiving our newsletter or for setting non-technically necessary cookies. For storing information on your device and accessing it, Section 25 para. 1 TDDDG also applies.
Art. 6 para. 1 lit. b GDPR (Contract or Pre-contractual Measures) – if processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures, particularly for processing your order.
Art. 6 para. 1 lit. c GDPR (Legal Obligation) – if we are legally obliged to process data, for example, due to commercial and tax law retention obligations.
Art. 6 para. 1 lit. f GDPR (Legitimate Interest) – if processing is necessary for the purposes of our legitimate interests and your interests or fundamental rights do not override them, for example, to ensure IT security, prevent fraud, and design our offer according to your needs.

We will indicate the legal basis for each specific processing operation below.

4. Hosting and Website Provision

Our online shop is operated on Shopify's e-commerce platform. For users in the European Economic Area, the provider is Shopify International Limited, Ireland, a company of Shopify Inc. based in Canada.

Shopify provides the technical infrastructure for our shop, stores the content of our website, and processes all data generated during the operation of the shop and order processing on our behalf. We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR.

The legal basis is Art. 6 para. 1 lit. b GDPR for the processing of the contractual relationship, and Art. 6 para. 1 lit. f GDPR for our legitimate interest in a secure, stable, and efficient operation of our online offering.

Server Log Files

When you access our website, information transmitted by your browser is automatically collected. This includes, in particular:

IP address of the requesting device
Date and time of access
Name and URL of the retrieved file
Website from which access is made (referrer URL)
Used browser, browser version, and operating system
Amount of data transferred and message about the success of the retrieval

This data is processed to enable a smooth connection setup and comfortable use of the website, to evaluate system security and stability, and to detect misuse. The legal basis is Art. 6 para. 1 lit. f GDPR. We do not combine this data with other data sources for the purpose of identifying you.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies such as Local Storage, Session Storage, and tracking pixels. Cookies are small text files that are stored on your device and contain certain information.

We distinguish between:

Technically necessary cookies – these are required for our website and the ordering process to function, for example, to save the contents of your shopping cart, to recognize you as a logged-in customer, or to provide security features. The legal basis for storage and access is Section 25 para. 2 No. 2 TDDDG, and for further processing Art. 6 para. 1 lit. b and lit. f GDPR.
Non-necessary cookies – these primarily include cookies for statistics, reach measurement, personalization, and advertising. We only use these if you have given your prior consent. The legal basis is Section 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

You can revoke your consent at any time with effect for the future by adjusting your cookie settings on our website or by sending us an email to support@shinorabeauty.com. The legality of the processing carried out until the revocation remains unaffected.

Regardless, you can set your browser so that cookies are generally not accepted or are deleted when the browser is closed. Please note that the functionality of our shop may be limited if you block technically necessary cookies.

6. Data Processing in the Online Shop

6.1 Order Processing

When you place an order with us, we process the data necessary for the execution of the purchase contract. This includes:

First and last name
Billing and shipping address
Email address
Phone number, if you provide it
Order and contract data (ordered items, quantity, price, order date, order number)
Payment data and information on payment status
Shipping and tracking data

The purpose of processing is the review and acceptance of your order, delivery of goods, payment processing, invoicing, processing of returns, cancellations and warranty cases, and communication with you about your order.

The legal basis is Art. 6 para. 1 lit. b GDPR. Insofar as we are legally obliged to retain order and invoice data, the legal basis is additionally Art. 6 para. 1 lit. c GDPR.

The provision of this data is necessary for the conclusion of the contract. Without it, we cannot process your order.

6.2 Customer Account

You can create a customer account in our shop. In doing so, we process the data you provide as well as your order history so that you can view your orders, register returns, and place future orders without re-entering your data. Registration is done via your email address and a confirmation code sent to that address.

The legal basis is Art. 6 para. 1 lit. b GDPR. You can have your customer account deleted at any time by sending us an email to support@shinorabeauty.com. Legal retention obligations remain unaffected.

6.3 Shipping and Logistics

To deliver your order, we pass on your name, shipping address, and, if necessary for delivery notification, your email address and phone number to the shipping and logistics company commissioned with the delivery. The legal basis is Art. 6 para. 1 lit. b GDPR.

6.4 Payment Processing

We use external payment service providers to process payments for your order. You enter payment data, especially card data, directly with the respective payment service provider. We do not collect or store full card data.

We use the following payment methods and providers:

Credit and Debit Card, and Shop Pay – processed via Shopify Payments, provided by Shopify International Limited, Ireland.
PayPal – provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Apple Pay – provided by Apple Distribution International Limited, Ireland.
Google Pay – provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As part of payment processing, we transmit the data required for payment, in particular name, billing address, email address, order number, and invoice amount, to the provider you have selected. The providers process this data partly as their own controllers, especially for fraud prevention and to fulfill their own legal obligations. Please also note the privacy policies of the respective provider in this regard.

The legal basis is Art. 6 para. 1 lit. b GDPR and, insofar as it concerns fraud prevention and the fulfillment of legal obligations, Art. 6 para. 1 lit. f and lit. c GDPR.

6.5 Returns and Refunds

If you register a return, we process your order and contact data, the stated reason for the return, and any photos of the product and packaging you have submitted. We use this data exclusively to process your return, to check for transport damage, and to process the refund. The legal basis is Art. 6 para. 1 lit. b GDPR, and Art. 6 para. 1 lit. f GDPR regarding the assertion of our own claims against transport companies.

7. Contact and Customer Service

If you contact us by email, via a contact form, or through another channel, we process the data you provide to process and respond to your inquiry. This typically includes your name, email address, order number, and the content of your message.

The legal basis is Art. 6 para. 1 lit. b GDPR if your inquiry concerns an existing or prospective contract; otherwise, Art. 6 para. 1 lit. f GDPR due to our legitimate interest in responding to inquiries.

We delete the data as soon as your inquiry has been fully processed and no legal retention obligations prevent deletion.

8. Newsletter and Email Marketing

For sending our newsletter and other marketing emails, we use the Klaviyo platform by Klaviyo, Inc., Boston, Massachusetts, USA. Klaviyo processes the data of our recipients on our behalf; we have concluded a data processing agreement with Klaviyo in accordance with Art. 28 GDPR.

Registration and Consent

If you subscribe to our newsletter, we process your email address and any other data you provide to send you information about our products, offers, and promotions.

The registration process uses a double opt-in procedure: after your registration, you will receive an email in which you must confirm your subscription. This ensures that no one is registered with someone else's email address. We log the registration, the time of confirmation, and the IP address used to be able to prove consent.

The legal basis is Art. 6 para. 1 lit. a GDPR. We base the logging of the registration on Art. 6 para. 1 lit. c and lit. f GDPR.

Performance Measurement

Our newsletters contain tracking pixels and individualized links, through which we can recognize whether and when an email was opened and which links were clicked. We use this information to align our content with the interests of our recipients and to measure the success of our campaigns. This evaluation is part of the consent you have given; the legal basis is Art. 6 para. 1 lit. a GDPR.

Unsubscription

You can revoke your consent at any time with future effect and unsubscribe from the newsletter. To do this, use the unsubscribe link at the end of each email or send us an email to support@shinorabeauty.com. After unsubscribing, we store your email address in a blacklist to ensure that you do not receive any further promotional emails; the legal basis for this is Art. 6 para. 1 lit. c and lit. f GDPR.

Advertising to Existing Customers

Insofar as we have received your email address in connection with a purchase, we may contact you for direct marketing of similar goods of our own on the basis of Section 7 para. 3 UWG. The legal basis in this respect is Art. 6 para. 1 lit. f GDPR. You can object to this use at any time without incurring any costs other than the transmission costs at the basic rates.

9. Web Analytics, Conversion Tracking, and Advertising

The services described in this section are only used if you have consented to the setting of the corresponding cookies and the reading of information from your device. The legal basis is Section 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with future effect.

9.1 Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool that allows us to manage and integrate tags and scripts from other services into our website. Google Tag Manager itself does not create user profiles, set analytical cookies, or collect personal data beyond what is necessary for delivering the tags. However, it triggers other tags that may, in turn, collect data. When Google Tag Manager is accessed, your IP address is transmitted to Google.

9.2 Google Ads Conversion Tracking and Remarketing

We use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to promote our offers on external websites and Google services.

As part of conversion tracking, a cookie is set when you access our website via a Google ad. This allows us and Google to recognize whether a user has performed a specific action after clicking on an ad, for example, completed an order. We receive statistical evaluations of the total number of users who clicked on an ad and the conversions achieved. We do not receive any information that could personally identify you.

Through remarketing functions, interest-based ads can also be delivered to you based on your usage behavior on our website.

Processed data includes online identifiers such as cookie IDs and click IDs (e.g., gclid, gbraid, wbraid), your IP address, information about the pages visited, and details of triggered events such as shopping cart actions or purchases.

Further information on data processing by Google and your setting options can be found in Google's privacy policy at policies.google.com/privacy and in the ad settings at adssettings.google.com.

9.3 Click and Attribution Tracking

We use our own click and attribution tracking to understand which advertising campaign or channel brought visitors to our shop and to measure the success of our marketing activities.

Campaign parameters are read from the accessed URL and stored (in particular utm_source, utm_medium, utm_campaign, utm_term, utm_content, as well as click IDs like gclid, gbraid, wbraid, and internal click IDs). This information is stored in your browser's memory, transmitted to our evaluation infrastructure, and assigned to the respective order as additional information.

If no campaign parameters are present when our website is accessed, a checksum derived from technical characteristics of your device (in particular browser identifier, screen resolution, language setting, and time zone) is calculated and transmitted to our evaluation infrastructure to find a previously stored campaign assignment. For this processing, your IP address is transmitted to the operator of the evaluation infrastructure.

The technical infrastructure for this tracking is provided by Supabase, Inc., USA. We have concluded data processing agreements with the service providers used in accordance with Art. 28 GDPR.

9.4 Display Optimization

We integrate a script from the service Qera Marketing on our website, which serves the technical optimization and adaptation of the display of our page content. Your IP address may be transmitted to the provider, and information about your use of our website may be processed.

10. Other Integrated Services

10.1 Font Awesome via cdnjs

For the uniform display of icons, we integrate the Font Awesome icon library via the Content Delivery Network cdnjs, which is operated by Cloudflare, Inc., USA. When you access a page, your browser loads the necessary files directly from the provider's servers. Your IP address is transmitted to Cloudflare in this process. The legal basis is Art. 6 para. 1 lit. f GDPR due to our legitimate interest in a uniform and fast-loading display of our website.

10.2 Shop Extensions

To design individual shop pages, we use the PageFly application, which runs as an extension within the Shopify platform. This essentially processes the same data that is generated when operating our shop, in particular technical access data. The legal basis for this is Art. 6 Para. 1 lit. f GDPR, based on our legitimate interest in tailoring our online offering to meet specific needs.

11. Recipients of Personal Data

We only pass on personal data if this is necessary to fulfill our contractual and legal obligations, if you have given your consent, or if we can rely on a legitimate interest. Recipients may include, in particular:

the operator of our shop platform and other IT service providers
payment service providers, banks, and fraud prevention providers
shipping, logistics, and fulfillment service providers
providers of services for email dispatch, marketing, reach measurement, and advertising
providers of customer service tools
tax advisors, auditors, and legal advisors
authorities and courts, insofar as we are legally obliged to provide information

Insofar as these recipients process data on our behalf and according to our instructions, we have concluded data processing agreements with them in accordance with Art. 28 GDPR.

12. Data Transfer to Third Countries

We are a company based in the United States of America. Personal data that you transmit to us will therefore regularly also be processed in the United States. In addition, we use service providers who process personal data in the United States or in other countries outside the European Economic Area or can access data stored there.

For the United States, the European Commission has issued an adequacy decision under Art. 45 GDPR with the EU-US Data Privacy Framework. If a recipient in the United States is certified under this framework, the transfer will take place on the basis of this adequacy decision.

If a recipient is not certified or the transfer takes place to another third country without an adequacy decision, we base the transfer on the standard contractual clauses issued by the European Commission in accordance with Art. 46 Para. 2 lit. c GDPR and, if necessary, take supplementary protective measures. In cases where we rely on your explicit consent, the transfer is based on Art. 49 Para. 1 lit. a GDPR.

We point out that third countries do not in all cases have a level of data protection equivalent to that of the European Union. In particular, authorities in these countries may, under certain circumstances, access personal data without effective legal remedies always being available.

You can request a copy of the guarantees we use at support@shinorabeauty.com.

13. Storage Duration

We process personal data only for as long as necessary for the respective purposes and then delete it, unless there are legal retention obligations. In detail, the following applies:

Order and contract data: Retention in accordance with commercial and tax law retention periods. These are generally ten years for accounting records and invoices, and generally six years for commercial letters, each calculated from the end of the calendar year in which the contract was completed.
Customer account data: for the duration of the existence of the customer account; after the deletion of the account, the aforementioned retention periods apply to the associated order data.
Newsletter data: until you revoke your consent; we also keep the evidence of consent and the blacklist for as long as necessary to fulfill proof obligations.
Customer service inquiries: until final processing, but at most, insofar as legal retention obligations or the pursuit or defense of legal claims require it.
Server log files: for a short period necessary to ensure operation and IT security.
Cookies and tracking data: according to the respective storage period of the individual cookie, at most until you revoke your consent.

In addition, we may store data for as long as is necessary to assert, exercise, or defend legal claims.

14. Your Rights as a Data Subject

You have the following rights under the General Data Protection Regulation:

Right of access (Art. 15 GDPR): You can request information about whether and which personal data we process about you, as well as about the processing purposes, the categories of data, the recipients, the planned storage period, the origin of the data, and the existence of automated decision-making. You can request a copy of the processed data.
Right to rectification (Art. 16 GDPR): You can request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.
Right to erasure (Art. 17 GDPR): You can request the erasure of your personal data if one of the legally stipulated reasons exists and no legal retention obligation prevents it.
Right to restriction of processing (Art. 18 GDPR): Under the legal conditions, you can request that we restrict the processing of your data, for example while we are checking the accuracy of disputed data.
Right to data portability (Art. 20 GDPR): You can request to receive the data you have provided to us in a structured, commonly used, and machine-readable format or to have it transmitted to another controller, as far as this is technically feasible.
Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Art. 6 Para. 1 lit. e or lit. f GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.
Right to object to direct marketing (Art. 21 Para. 2 GDPR): If we process your personal data for the purpose of direct marketing, you have the right to object to this processing at any time and without giving reasons. After your objection, we will no longer process your data for this purpose.
Right to withdraw consent (Art. 7 Para. 3 GDPR): You can withdraw any consent you have given us at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

To exercise your rights, simply send an informal message to support@shinorabeauty.com. We will process your request immediately, but in any case within the statutory deadlines. To ensure the security of your data, we may need to verify your identity before we can comply with your request. There are no costs for exercising your rights.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right, pursuant to Art. 77 GDPR, to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the General Data Protection Regulation.

You can contact the supervisory authority of your usual place of residence, your place of work, or the place of the alleged infringement. An overview of the competent supervisory authorities in Germany and in the other member states can be found on the website of the European Data Protection Board at edpb.europa.eu.

15. Necessity of Providing Data

Insofar as we require personal data to fulfill a contract with you or due to legal requirements, the provision of this data is necessary. Without it, we cannot conclude or fulfill the contract. In all other cases, the provision is voluntary; if you do not give consent or revoke it, you will not suffer any disadvantages beyond the possibly limited usability of individual functions.

16. No Automated Decision-Making

Automated individual decision-making, including profiling within the meaning of Art. 22 GDPR, which produces legal effects concerning you or similarly significantly affects you, does not take place.

17. Data Security

We take appropriate technical and organizational measures in accordance with Art. 32 GDPR to protect your data against loss, destruction, manipulation, and unauthorized access. Data transmission on our website takes place encrypted via TLS. You can recognize an encrypted connection by the character string "https://" in the address bar of your browser and by the padlock symbol. Our security measures are continuously reviewed and adapted in line with technological developments.

18. Minors

Our offer is not directed at children. We do not knowingly collect personal data from individuals under the age of 16. Should we become aware that we are processing data of a person under 16 without the consent of their legal guardians, we will delete this data immediately.

19. Changes to this Privacy Policy

We will adapt this privacy policy if the services we use, our processing, or the legal framework changes. The version published on this page at the time is always valid.

20. Contact for Data Protection Questions

For questions regarding data protection and the exercise of your rights, please contact: