Privacy policy | Dune Jewels

Template — to be completed by Dune JewelsThis page is a draft template for the redesign demo. All fields in [brackets] must be completed with Dune Jewels’ real company details, and the text should be reviewed by a legal professional before going live. It is not legal advice. A German version should be published alongside.

Last updated: [date]

1. Controller

The controller responsible for processing personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:
[Company name / full name of sole trader], [Street and number, postcode, city, country], email: [contact email]

[Data protection officer contact, if one is appointed — otherwise delete]

2. What we process and why

Visiting the website

When you visit the site, technically necessary data (e.g. IP address, browser type, date and time of access) is processed to provide and secure the website. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, functioning website).

Orders and customer account

To process your order we process your name, address, email, phone number (optional), order and payment details. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (legal retention obligations).

Contact form and email

If you contact us, we process the data you provide in order to answer your enquiry. Legal basis: Art. 6 (1) (b) or (f) GDPR.

We only send our newsletter with your consent (Art. 6 (1) (a) GDPR), using a double opt-in procedure. You can unsubscribe at any time via the link in every email. Newsletter provider: [name and address of provider, e.g. Shopify Email / Klaviyo].

3. Shop platform, payment and shipping

Our shop runs on Shopify, which processes data on our behalf under a data processing agreement. [Shopify contracting entity and safeguards for transfers outside the EU — confirm from your Shopify agreement (e.g. EU-US Data Privacy Framework / standard contractual clauses)].

Payment providers: [list, e.g. Shopify Payments, PayPal, Google Pay]. Payment data is processed by the respective provider.

Shipping: we pass your name and address to the carrier ([carrier names]) in order to deliver your order.

4. Cookies and similar technologies

We use technically necessary cookies to run the shop (§ 25 (2) TDDDG). Analytics and marketing cookies and pixels are only used with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can give or withdraw at any time in the cookie settings.

Tools used with consent: [list each tool with provider, purpose and storage period — e.g. Shopify Analytics, Meta Pixel, Pinterest Tag].

5. Social media

We link to our profiles on Instagram and Threads. No data is transferred to the platform operator until you click such a link.

6. Storage period

We delete personal data once it is no longer needed for the purpose for which it was collected, unless statutory retention periods apply (e.g. for accounting records).

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, for example [competent supervisory authority].

8. Contact

For privacy questions please contact [contact email].