PICK 3 ITEMS, PAY FOR 2
Privacy policy
This policy explains how we collect, use and share personal data when you visit or buy from delency.com. It applies worldwide. Where we name provisions of German or European law, these apply to you if you are in the European Union, the EEA or the United Kingdom.
Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation is:
Dèlency, owner Birhat Shahin
Sutthauser Str. 206
49080 Osnabrück
Germany
Email: support@delency.com
Phone: +49 1551 0572574
We are not required to appoint a data protection officer, because we do not regularly employ twenty or more persons in the processing of personal data.
What personal data is
Personal data means any information relating to an identified or identifiable natural person. This includes your name, your address, your email address, your phone number, your order history and online identifiers such as your IP address.
Legal bases we rely on
Where we ask for your consent, Art. 6 (1) (a) GDPR is the legal basis. Where processing is necessary to perform a contract with you or to take steps before entering into a contract, Art. 6 (1) (b) GDPR applies. Where processing is necessary to comply with a legal obligation, Art. 6 (1) (c) GDPR applies. Where processing is necessary for our legitimate interests or those of a third party, and your interests and fundamental rights do not override them, Art. 6 (1) (f) GDPR applies.
Where information is stored on or read from your device, Section 25 TDDDG applies in addition. Storage and access that is strictly necessary to provide the service you requested is covered by Section 25 (2) no. 2 TDDDG and does not require consent. Everything else requires your consent under Section 25 (1) TDDDG.
Server log files
Every time this website is called up, our hosting provider records the following in server log files: browser type and version, operating system, internet service provider, IP address, date and time of access, the page from which you reached us, and the pages you open on our site. This data is not merged with other personal data. It is processed to operate the site securely and to detect and defend against attacks. Legal basis: Art. 6 (1) (f) GDPR.
Cookies
Cookies are small files stored on your device by your browser. We use two kinds. Strictly necessary cookies keep the shop working: shopping cart, checkout, login, country and language selection, and fraud prevention. Storage and access are covered by Section 25 (2) no. 2 TDDDG and require no consent. The subsequent processing of the data is based on Art. 6 (1) (b) and (f) GDPR.
Analytics and marketing cookies are set only if you consent. Storage and access are based on Section 25 (1) TDDDG, the subsequent processing on Art. 6 (1) (a) GDPR. You can change or withdraw your choice at any time through the cookie settings on our website. You can also delete cookies and block them in your browser settings. If you block them, parts of the shop may stop working.
Consent management
Purpose. We use a consent management tool to obtain, record and document your cookie choices and to make them changeable at any time.
Legal basis. Art. 6 (1) (c) GDPR, because we are legally required to demonstrate consent, and Section 25 (2) no. 2 TDDDG for the storage of your choice on your device.
Recipient. Pandectes, operated by Pandectes P.C., Greece, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.
Third country transfer. None. Processing takes place inside the European Union.
Retention. Consent records are kept for as long as we must be able to demonstrate your consent, and for up to three years after it ends.
Obligation to provide. Recording your choice is a legal requirement. Without it we cannot set any non essential cookies.
What we collect and why
Device information. Browser type, IP address, time zone, language, the pages and products you view, the site or search term that brought you to us, and how you interact with the shop. Collected through cookies, log files, web beacons, tags and pixels.
Order information. Your name, billing address, delivery address, email address, phone number and payment information. Full card numbers are processed by the payment provider and are never stored by us.
Communication data. If you write to us by email or through a contact form, we process the content of your message and your contact details in order to reply. Legal basis: Art. 6 (1) (b) GDPR where your message concerns an order or a possible order, otherwise Art. 6 (1) (f) GDPR. We delete this data once the matter is closed and no retention period requires us to keep it.
Newsletter data. If you subscribe, we store your email address, the date and time of your sign up and the IP address used, so that we can demonstrate your consent. Legal basis: Art. 6 (1) (a) GDPR. Every email contains an unsubscribe link. We keep your address until you unsubscribe.
Shop platform
Purpose. Our shop is hosted on Shopify. Shopify provides the store, the checkout and the customer account, and processes the data described above on our behalf.
Legal basis. Art. 6 (1) (b) GDPR for the performance of your order and Art. 6 (1) (f) GDPR for the secure and reliable operation of the shop. Strictly necessary cookies are covered by Section 25 (2) no. 2 TDDDG.
Recipient. Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Third country transfer. Shopify may process data outside the European Economic Area, in particular in Canada and the United States. Canada is covered by an adequacy decision of the European Commission. For the United States, the transfer is based on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Retention. Order and invoice data for the periods required by German commercial and tax law, up to ten years. Other data until it is no longer needed.
Obligation to provide. Providing your order data is necessary to conclude the contract. Without it we cannot process an order.
More information. www.shopify.com/legal/privacy
We also use certain enhanced Shopify features that draw on data from your interactions with our shop, with other merchants and with Shopify. For those features Shopify is the controller in its own right, including for responding to requests to exercise your rights. See www.shopify.com/legal/privacy/app-users and privacy.shopify.com.
Payment providers
Purpose. To process your payment with the method you choose at checkout.
Legal basis. Art. 6 (1) (b) GDPR.
Recipients. Depending on your choice: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Shopify Payments (Europe) Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland; Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes your payment data under its own responsibility and its own privacy policy.
Third country transfer. Depending on the provider, data may be transferred to third countries. The providers state Standard Contractual Clauses or an adequacy decision as the basis.
Retention. As required by commercial and tax law, up to ten years.
Obligation to provide. Payment data is necessary to perform the contract. Without it the order cannot be completed.
Depending on the payment method, for example invoice or direct debit, the provider may pass your data to credit agencies for identity and credit checks. This is done by the provider under its own responsibility.
Shipping
Purpose. To deliver your order and to send delivery notifications.
Legal basis. Art. 6 (1) (b) GDPR.
Recipients. The carrier delivering your parcel, in particular Deutsche Post DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany. We pass on your name, your delivery address and, where needed for notifications, your email address or phone number.
Third country transfer. For deliveries outside the European Union, your data is passed to the carrier and to the customs authorities of the destination country, as required by customs law.
Retention. As required by commercial and tax law.
Obligation to provide. A delivery address is necessary to perform the contract.
Google Analytics
Purpose. To understand how visitors use the website and to improve it. Google Analytics uses cookies and processes device information as described above.
Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.
Recipients. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Third country transfer. Data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision under Art. 45 GDPR. In addition, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place.
Retention. Device data collected for analytics is stored for a maximum of fourteen months.
Withdrawal. You can withdraw your consent at any time with effect for the future through the cookie settings on our website, or by using the browser add-on at tools.google.com/dlpage/gaoptout. Withdrawal does not affect the lawfulness of processing carried out before it.
Obligation to provide. None.
More information. policies.google.com/privacy
Google Ads, conversion tracking and remarketing
Purpose. To advertise our products in Google services, including Google Search, Google Shopping, the Google Display Network and YouTube, to measure whether an advertisement led to a purchase, and to show advertising to people who have already visited our shop. Google sets cookies and processes your usage behaviour, including pages viewed, click behaviour and technical data such as your IP address. We also use the Google sales channel for Shopify, so that our products can appear in Google Shopping and other Google services.
Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.
Recipients. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Third country transfer. As described for Google Analytics.
Retention. Remarketing cookies have a lifetime of up to 540 days. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure.
Withdrawal. At any time through the cookie settings on our website, or in your Google ad settings at adssettings.google.com.
Obligation to provide. None.
More information. policies.google.com/technologies/ads
Meta pixel and the Facebook and Instagram sales channel
Purpose. We use the Meta pixel and the Facebook and Instagram sales channel for Shopify. This lets us measure whether an advertisement on Facebook or Instagram led to a visit or a purchase, build audiences for advertising, and show our products in Meta services. Meta receives HTTP header information including your IP address, browser information and the page you are on, pixel specific data including the pixel ID and Meta cookie data, and event data such as products viewed and purchases completed. If you have a Meta account, Meta can link this to your account.
Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.
Recipients. Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. We and Meta are joint controllers for the collection and transfer of this data within the meaning of Art. 26 GDPR. Meta processes the data further under its own responsibility.
Third country transfer. Data may be transferred to the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place.
Retention. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure. Meta states its own retention periods in its privacy policy.
Withdrawal. At any time through the cookie settings on our website, and in your Meta ad settings.
Obligation to provide. None.
More information. www.facebook.com/privacy/policy
TikTok pixel
Purpose. We use the TikTok pixel so that we can measure whether an advertisement or a post on TikTok led to a visit or a purchase, build audiences for advertising, and improve our campaigns. The pixel processes device and browser information, your IP address, the pages you view and events such as adding a product to the cart or completing a purchase. If you have a TikTok account, TikTok can link this to your account.
Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.
Recipients. TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Aviation House, 125 Kingsway, London, WC2B 6NH, United Kingdom. We and TikTok are joint controllers for the collection and transfer of this data within the meaning of Art. 26 GDPR. TikTok processes the data further under its own responsibility.
Third country transfer. TikTok stores data of European users in data centres in Europe. TikTok states that staff in third countries, including China, Singapore and the United States, can access this data for maintenance and support. The United Kingdom is covered by an adequacy decision under Art. 45 GDPR. For China and other third countries without an adequacy decision, TikTok relies on Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with additional measures. We point out that the level of protection in those countries may not correspond to that in the European Union, and that effective legal remedies may not be available to the same extent. You can find TikTok's own information on this in its privacy policy.
Retention. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure. TikTok states its own retention periods in its privacy policy.
Withdrawal. At any time through the cookie settings on our website, and in your TikTok ad settings.
Obligation to provide. None.
More information. www.tiktok.com/legal/page/eea/privacy-policy/en
Further advertising platforms
Purpose. We advertise our products on the platforms named above. We may extend our advertising to further platforms, for example Pinterest, Snapchat or Microsoft Advertising. Where we do, those platforms use the same kind of technology as described above: a pixel or tag that processes device and browser information, your IP address, the pages you view and events such as adding a product to the cart or completing a purchase, in order to measure advertising and to build audiences.
Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. No advertising technology is loaded on our website unless you have consented to it.
How you can always see what is active. Every advertising provider we use is listed by name in the cookie settings on our website, together with its purpose, before you give consent. The cookie settings are therefore always the complete and current list. We also update this policy with a separate section for each provider before we start using it.
Third country transfer. Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Withdrawal. At any time through the cookie settings on our website.
Obligation to provide. None.
Omnisend, newsletter, email and SMS marketing
Purpose. We use Omnisend to create and send our newsletter, SMS messages and transactional emails, to display sign up forms and pop ups on our website, and to manage our subscriber list. Omnisend processes your email address, your mobile number where you have given it, the date, time and IP address of your sign up, and interaction data. Our emails contain tracking pixels and personalised links, so that we can see whether an email was opened and which links were clicked, and improve our content accordingly.
Legal basis. Art. 6 (1) (a) GDPR for the newsletter and for open and click measurement. Where we send you information about goods similar to ones you have already bought, we may also rely on Section 7 (3) UWG. Storage and access on your device for open and click measurement are based on Section 25 (1) TDDDG.
Recipient. UAB Omnisend, Verkių g. 25C-1, LT-08223 Vilnius, Lithuania.
Third country transfer. Omnisend also operates entities in the United Kingdom and the United States. Where data is transferred there, the transfer is based on the adequacy decision for the United Kingdom or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Retention. Until you unsubscribe or withdraw your consent. Records of your consent are kept for up to three years after that, so that we can demonstrate it.
Withdrawal. At any time with effect for the future, through the unsubscribe link in every email or by writing to support@delency.com. You can object to direct marketing at any time and free of charge.
Obligation to provide. None. Without your email address we cannot send you a newsletter.
More information. www.omnisend.com/privacy
Pop ups and on site marketing
Purpose. We use EcomSend to display pop ups and sign up forms, for example for a discount on your first order. It processes device information and the email address you enter.
Legal basis. Art. 6 (1) (a) GDPR for the sign up and Art. 6 (1) (f) GDPR for displaying the form. Storage and access on your device are based on Section 25 (1) TDDDG.
Recipient. Channelwill, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.
Third country transfer. Where data is processed outside the European Economic Area, the transfer is based on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Retention. Until you unsubscribe or withdraw your consent.
Withdrawal. At any time through the cookie settings on our website or by writing to support@delency.com.
Obligation to provide. None.
Reviews and ratings
Purpose. After a purchase we may invite you by email to review the product and our shop. For this we pass your email address, your order number and the items you bought to the review provider, which sends the invitation. If you submit a review, we publish your first name, your rating, your review text and any photo you upload on our website.
Legal basis. Art. 6 (1) (f) GDPR for the review invitation, our legitimate interest being to obtain feedback and to inform other customers. Art. 6 (1) (a) GDPR for the publication of your review and any photo. Where the review widget stores information on or reads it from your device, this happens only with your consent under Section 25 (1) TDDDG.
Recipient. Loox Ltd., Israel, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. Israel is covered by an adequacy decision of the European Commission under Art. 45 GDPR.
Retention. Published reviews are kept until you ask us to remove them. Invitation data is deleted once the invitation has been sent and the period for a reminder has passed.
Withdrawal and objection. You can object to the review invitation at any time, and withdraw the publication of your review at any time, by writing to support@delency.com.
Obligation to provide. None. Submitting a review is entirely voluntary.
Instagram feed
Purpose. We display a feed of our own Instagram posts on our website, using Instafeed. To deliver the images and the feed to your browser, the provider and the Instagram content delivery network necessarily receive your IP address.
Legal basis. Art. 6 (1) (f) GDPR, our legitimate interest being an appealing and functional website. Where storage on or access to your device is involved, this takes place only with your consent under Section 25 (1) TDDDG.
Recipients. Nfcube Ltd., and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the delivery of the images. If you are logged in to Instagram, Meta can link the visit to your account.
Third country transfer. Where data is processed outside the European Economic Area, in particular in the United States, the transfer is based on the EU-U.S. Data Privacy Framework under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Retention. The IP address is used to deliver the content and is not stored by us.
Objection. You may object at any time under Art. 21 GDPR by writing to support@delency.com.
Obligation to provide. None.
Error monitoring and website stability
Purpose. We use an error monitoring service that records technical faults on our website, so that we can find and fix them. It processes the type of error, the page on which it occurred, your browser and operating system and your IP address. It does not create user profiles and is not used for advertising.
Legal basis. Art. 6 (1) (f) GDPR. Our legitimate interest is to operate a functioning and secure shop.
Recipient. Functional Software, Inc., trading as Sentry, 45 Fremont Street, San Francisco, CA 94105, USA, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.
Third country transfer. Data is transferred to the United States, based on the EU-U.S. Data Privacy Framework under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Retention. Error reports are deleted after 90 days at the latest.
Objection. You may object at any time under Art. 21 GDPR by writing to support@delency.com.
Obligation to provide. None.
Other service providers
We use further providers for individual shop functions. They process only what their function requires and only on our instructions, under data processing agreements pursuant to Art. 28 GDPR. These are: a provider for the display of trust, size and delivery information in the shop, which processes device information and your IP address in order to deliver the display, on the basis of Art. 6 (1) (f) GDPR; the provider of the withdrawal button in our footer, which processes the name, order number and email address you enter, on the basis of Art. 6 (1) (b) GDPR in conjunction with Section 355 of the German Civil Code (BGB); content delivery networks that deliver scripts, fonts, images and stylesheets to your browser and necessarily receive your IP address for that purpose, on the basis of Art. 6 (1) (f) GDPR.
Where any of these providers processes data outside the European Economic Area, in particular in the United States, the transfer is based on an adequacy decision under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR. Where a function stores information on or reads it from your device beyond what is strictly necessary to provide the service you requested, this happens only with your consent under Section 25 (1) TDDDG.
Under Art. 15 (1) (c) GDPR you may ask us at any time for the identity of every recipient of your personal data. Write to support@delency.com and we will name them. Beyond this, we may disclose personal data in order to comply with applicable law, to respond to lawful requests from authorities, or to establish, exercise or defend legal claims. We do not sell your personal data.
Transfers to third countries
Some of our providers process data outside the European Economic Area, in particular in the United States and Canada. In those cases the transfer is based on an adequacy decision of the European Commission under Art. 45 GDPR, for example for Canada, the United Kingdom, Israel and for United States companies certified under the EU-U.S. Data Privacy Framework, or on Standard Contractual Clauses approved by the European Commission under Art. 46 (2) (c) GDPR. Please note that in some third countries, in particular the United States, public authorities may have access rights that go beyond what European law allows, and that effective legal remedies may not be available to the same extent. Where we transfer data on this basis, we take additional measures where necessary to protect your rights.
How long we keep your data
Order and invoice data: for the periods required by German commercial and tax law, up to ten years. Communication data: for as long as needed to handle your enquiry and any follow up questions. Newsletter data: until you unsubscribe, consent records for up to three years afterwards. Device data collected for analytics: a maximum of fourteen months. Consent records for cookies: up to three years. Where no retention obligation applies, we delete personal data once the purpose has been achieved, or on request.
Is providing data required
Providing the data marked as required in the order process is necessary in order to enter into and perform a contract with us. Without it we cannot accept or deliver an order. Retaining order and invoice data is a legal obligation under commercial and tax law. All other data, in particular for analytics, advertising, the newsletter and reviews, is provided entirely voluntarily. If you do not provide it, or withdraw your consent, you suffer no disadvantage and can continue to use the shop, although individual functions may then be unavailable.
Automated decision making and profiling
We do not use automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Where you have consented to advertising cookies, advertising is selected for you based on your usage behaviour. This does not produce legal effects for you and you can withdraw your consent at any time. Payment providers may carry out automated identity or credit checks for certain payment methods. Those checks are carried out by the provider under its own responsibility and you can find the details in its privacy policy.
Your rights
If you are in the European Economic Area or the United Kingdom you have the following rights in relation to us: access to the personal data we hold about you, Art. 15 GDPR; rectification of inaccurate or incomplete data, Art. 16 GDPR; erasure, Art. 17 GDPR; restriction of processing, Art. 18 GDPR; to be informed about recipients of any rectification, erasure or restriction, Art. 19 GDPR; data portability in a structured, commonly used and machine readable format, Art. 20 GDPR; to withdraw consent at any time with effect for the future, Art. 7 (3) GDPR.
Right to object, Art. 21 GDPR. Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons, and we will stop.
To exercise any of these rights, write to support@delency.com.
Right to complain, Art. 77 GDPR. You may lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
If you are outside the EEA and the United Kingdom
We apply the same standards to your data. The rights available to you under your local data protection law are unaffected. If you are a resident of a United States state with its own privacy law, you may have the right to know what personal data we collect, to request access to it, to request its deletion or correction, and to opt out of the sale or sharing of personal data and of targeted advertising. We do not sell personal data. To opt out of targeted advertising, use the cookie settings on our website. To exercise any other right, write to support@delency.com. We will not discriminate against you for exercising these rights.
Minors
This website is not intended for persons under the age of eighteen. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us and we will delete it.
Security
We use technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction and access by unauthorised persons. Data is transmitted in encrypted form. We review our measures regularly and adapt them as technology develops.
Changes to this policy
We may update this policy from time to time to reflect changes to our practices, or for operational, legal or regulatory reasons. The current version is always available on this page.
Contact
For any question about this policy or about how we handle your data, or to make a complaint, write to us:
Dèlency, owner Birhat Shahin
Sutthauser Str. 206
49080 Osnabrück
Germany
support@delency.com
+49 1551 0572574
