Privacy policy

Privacy Policy

This English version is a translation for your convenience. The German version is legally binding.

1. Controller

The controller responsible for processing personal data on this website is:

MyMysteryBox
Owner: Suleman Mirza
Waldstraße 5–7
56579 Bonefeld
Germany

Email: servicehotline@mymysterybox.de
Phone: +49 2684 9791880
VAT ID: DE368956891

2. General information on data processing

We process personal data exclusively within the framework of the applicable data protection regulations.

Personal data is any information relating to an identified or identifiable natural person. This includes in particular name, address, email address, phone number, IP address as well as order and payment information.

Depending on the type of processing, it is based in particular on:

  • Art. 6(1)(a) GDPR – consent,
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures,
  • Art. 6(1)(c) GDPR – compliance with legal obligations,
  • Art. 6(1)(f) GDPR – legitimate interests.

3. Hosting and shop system – Shopify

Our online shop is operated via Shopify.

Shopify provides us with the technical infrastructure for operating the online shop and processes personal data that arises when you visit our shop, use the website or place an order.

This may include in particular:

  • IP address,
  • device and browser information,
  • usage data,
  • contact details,
  • customer account data,
  • order data,
  • transaction data,
  • shipping information.

The processing serves in particular to provide and securely operate our online shop and to process orders.

Depending on the processing, it is based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

When using Shopify, personal data may also be processed outside the European Economic Area. Where necessary, the legally required mechanisms for safeguarding international data transfers are used.

Further information on the processing of personal data by Shopify can be found in Shopify's privacy information.

4. Orders and contract processing

When you place an order in our online shop, we process the data required to perform the purchase contract.

This includes in particular:

  • first and last name,
  • billing address,
  • delivery address,
  • email address,
  • phone number, if provided,
  • products ordered,
  • order number,
  • order and payment information,
  • shipping information.

The processing serves to handle your order, process payment, deliver the goods, handle returns and complaints, and communicate with you.

The legal basis is Art. 6(1)(b) GDPR.

Where we are legally obliged to retain certain business and invoice records, further storage is based on Art. 6(1)(c) GDPR.

5. Payment processing

PayPal

If you choose PayPal as your payment method, the data required to carry out the payment is transmitted to or processed by PayPal.

This may include in particular:

  • name,
  • email address,
  • billing information,
  • payment information,
  • transaction data,
  • order value,
  • information on the respective payment.

The processing serves to handle the payment and perform the purchase contract on the basis of Art. 6(1)(b) GDPR.

PayPal may also process personal data as an independent controller, for example for fraud prevention, identity verification or compliance with legal obligations.

Further information can be found in PayPal's current privacy policy.

Credit card, Apple Pay, Google Pay, Shop Pay and UnionPay

If you pay by credit card, Apple Pay, Google Pay, Shop Pay or UnionPay, the payment is processed via Shopify Payments, a payment service of our shop system provider Shopify. The data required for the payment (in particular name, billing address, email address, payment and card details, transaction data and order value) is transmitted to Shopify and to Stripe, the payment service provider used by Shopify. We do not store complete card details.

The legal basis is Art. 6(1)(b) GDPR; for fraud prevention, Art. 6(1)(f) GDPR may also apply.

When you use Apple Pay or Google Pay, Apple or Google also process data in accordance with their own privacy policies.

6. Shipping and delivery

To carry out your order, we pass on the personal data required for delivery to the shipping company commissioned with the delivery.

This includes in particular:

  • name,
  • delivery address,
  • email address, if applicable,
  • phone number, if applicable,
  • shipping information required for delivery.

The processing serves to perform the purchase contract on the basis of Art. 6(1)(b) GDPR.

7. Customer service and contact

If you contact us by email, phone or otherwise, we process the data you provide in order to handle your request.

This may include in particular:

  • name,
  • email address,
  • phone number,
  • order number,
  • content of your request,
  • other information you provide voluntarily.

If your request relates to an order or a contract, processing is based on Art. 6(1)(b) GDPR.

For general requests, processing may be based on our legitimate interest in proper customer communication pursuant to Art. 6(1)(f) GDPR.

8. Customer account

Where our online shop allows you to create a customer account, we process the personal data you provide in order to set up and manage your customer account.

This may include in particular:

  • name,
  • email address,
  • address,
  • order history,
  • account settings.

The processing serves to provide the customer account functions you have requested, on the basis of Art. 6(1)(b) GDPR.

9. Cookies and similar technologies

Our website uses cookies and comparable technologies.

Cookies are small pieces of information that can be stored on or read from your device.

Technically necessary cookies

Certain cookies and similar technologies are necessary for our online shop to function technically and to provide functions you have expressly requested.

These may include, for example, cookies for the following functions:

  • shopping cart,
  • checkout,
  • security,
  • login,
  • language settings,
  • technical session management.

Where storing or accessing information on your device is strictly necessary to provide a service you have expressly requested, no prior consent is required.

Non-essential cookies

Where cookies or comparable technologies that are not technically necessary are used, they are generally only used after you have given your consent.

You can change or withdraw your consent with effect for the future via the privacy or cookie settings provided on our website.

10. Shopify analytics and privacy functions

As part of the technical operation of the shop, Shopify may process usage and device information.

Which analytics, personalisation and privacy functions are active depends on the configuration of our Shopify shop and on your choices in the cookie or privacy settings.

Where consent is required for a particular processing operation, this processing only takes place after you have given your consent.

11. Marketing and newsletter

If you expressly sign up for a newsletter or other electronic marketing communication, we use the contact details you provide for this purpose.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in a marketing email or by contacting us.

Transactional messages about your order, payment, delivery, return or customer account are not affected by this.

12. No external advertising pixels

According to our current shop configuration, we do not use independently integrated advertising pixels from Meta, TikTok or Google for personalised advertising.

Should corresponding marketing or tracking services be used in the future, this privacy policy will be updated accordingly and, where legally required, your consent will be obtained beforehand.

13. Disclosure of personal data

We only pass on personal data if:

  • this is necessary to perform the contract,
  • this is required by a legal obligation,
  • this is permitted on the basis of a legitimate interest,
  • or you have given your prior consent.

Recipients or categories of recipients may in particular be:

  • Shopify as shop and hosting provider,
  • PayPal, if you choose this payment method,
  • Shopify Payments and Stripe for payments by credit card, Apple Pay, Google Pay, Shop Pay or UnionPay,
  • Apple or Google for payments with Apple Pay or Google Pay,
  • shipping and logistics companies,
  • IT and technical service providers,
  • tax advisors and accounting service providers,
  • authorities, where there is a legal obligation.

14. International data transfers

When using internationally active service providers such as Shopify, Stripe or PayPal, personal data may be processed outside Germany or outside the European Economic Area.

Where there is no adequacy decision for a recipient country, data is only transferred in compliance with the legal requirements for international data transfers, for example using appropriate safeguards such as standard contractual clauses.

15. Storage period

We only store personal data for as long as is necessary for the respective purpose of processing.

Once the respective purpose no longer applies, the data is deleted unless there are statutory retention obligations, legitimate interests or other legal grounds for further storage.

In particular, commercial and tax law requirements may mean that certain contract, order and invoice data must be retained for a legally prescribed period.

16. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

However, completely risk-free data transmission over the internet cannot be ensured.

17. Your data protection rights

Subject to the statutory requirements, you have in particular the following rights:

  • Right of access to the personal data we process,
  • right to rectification of inaccurate personal data,
  • right to erasure of personal data,
  • right to restriction of processing,
  • right to data portability,
  • right to object to certain processing,
  • right to withdraw consent with effect for the future.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, you can contact us:

Email: servicehotline@mymysterybox.de

18. Objection to processing based on legitimate interests

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right, if the statutory requirements are met, to object to this processing on grounds relating to your particular situation.

If personal data is processed for direct marketing purposes, you may object to this processing at any time.

19. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.

20. Children's data

Our online shop is not specifically directed at children.

We do not knowingly collect personal data from children without any required consent of their legal guardians.

Should we become aware that such data has been processed unlawfully, we will take appropriate measures.

21. Use of artificial intelligence

We may use AI-assisted tools internally to support general business tasks, for example when creating or revising texts, concepts or media content.

We do not deliberately transmit personal customer data to publicly accessible AI services for these purposes.

No automated decision-making that has legal effects on you or similarly significantly affects you takes place.

22. Changes to this privacy policy

We reserve the right to adapt this privacy policy if legal requirements, technical functions of our shop or the service providers we use change.

The version currently published on this website applies.

23. Data protection contact

If you have any questions about the processing of your personal data or about exercising your data protection rights, you can reach us at:

MyMysteryBox
Owner: Suleman Mirza
Waldstraße 5–7
56579 Bonefeld
Germany

Email: servicehotline@mymysterybox.de
Phone: +49 2684 9791880