Legal notice

Last updated: July 2026

Protecting your personal data is important to us. Below we inform you about how we handle your data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Controller

The controller within the meaning of the GDPR is:

Finor GmbH
Managing Director: David Ligas
Kurfürstendamm 194
10707 Berlin, Germany
E-mail: info@finecosmetic.club

2. General information on data processing

As a matter of principle, we process our users' personal data only to the extent necessary to provide a functional website as well as our content and services. Processing takes place on the basis of consent (Art. 6(1)(a) GDPR), for the performance of a contract (Art. 6(1)(b) GDPR), on the basis of a legitimate interest (Art. 6(1)(f) GDPR) or on the basis of a legal obligation (Art. 6(1)(c) GDPR).

3. Hosting and shop system – Shopify

Our online shop is operated on the platform of Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify provides hosting, SSL encryption, databases and the Content Delivery Network (CDN).

When you visit our shop, Shopify automatically collects data in server log files, including IP address, browser type and version, operating system, referrer URL as well as the date and time of access. This data is processed to ensure trouble-free operation and security (Art. 6(1)(f) GDPR).

Shopify may process data in data centres outside the EU, in particular in the USA and Canada. The data transfer takes place on the basis of standard contractual clauses (Art. 46(2)(c) GDPR); for Canada an adequacy decision exists (Art. 45 GDPR). Further information: Shopify's Privacy Policy.

4. Fonts

To display our website we use the fonts Figtree and Merriweather. These are loaded via Shopify's own font CDN (fonts.shopifycdn.com). No direct request is made to Google servers; no personal data is transferred to Google.

5. Customer account and ordering process

When you place an order or create a customer account, we collect the data required to process the contract: name, e-mail address, delivery address, billing address and, where applicable, telephone number. Processing takes place for the performance of the contract (Art. 6(1)(b) GDPR). Your data is deleted after the commercial and tax retention periods have expired (usually 6 or 10 years), unless another legal basis exists.

6. Shipping

To deliver your order, we pass on your name and delivery address as well as, if you have consented, your e-mail address for delivery notification to the shipping service provider commissioned with the delivery (Art. 6(1)(b) GDPR). Depending on the destination country, we ship with DHL Paket GmbH (Sträßchensweg 10, 53113 Bonn), FedEx (FedEx Express Deutschland GmbH) or UPS (United Parcel Service Deutschland S.à r.l. & Co. OHG). Logistics and shipping are handled by our fulfilment partner LSM Fulfillment GmbH as a processor.

7. Payment processing

7.1 Shopify Payments (credit card, Shop Pay, Apple Pay, Google Pay)

Payments by credit card (Visa, Mastercard and others), Shop Pay, Apple Pay and Google Pay are processed via Shopify Payments, a service of Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland). Your payment data is transmitted directly to Stripe (Art. 6(1)(b) GDPR). Further information: Stripe's Privacy Policy.

7.2 PayPal

When paying via PayPal, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) (Art. 6(1)(b) GDPR). Further information: PayPal's Privacy Policy.

7.3 Klarna

When paying via Klarna (Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden), your personal data and order information are transmitted to Klarna in order to carry out payment processing and, where applicable, an identity and credit check (Art. 6(1)(b) GDPR). Further information: Klarna's Privacy Policy.

7.4 Prepayment / bank transfer

When paying by bank transfer, the data associated with your transfer (name, IBAN, reference) is processed by the credit institutions involved for payment processing (Art. 6(1)(b) GDPR).

8. Cookies and consent management

Our website uses cookies. We distinguish between:

Technically necessary cookies: required for the operation of the shop (e.g. shopping cart, session management). Legal basis: Art. 6(1)(f) or (b) GDPR, Section 25(2) TDDDG.

Analytics and marketing cookies: only set after your express consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Consent is obtained via Shopify's own cookie banner. You can withdraw your consent at any time with effect for the future by adjusting your cookie settings via the banner or your browser. In addition, you can object to the sharing of data for personalised advertising via our Privacy settings page.

9. Web analytics – Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and similar technologies that enable an analysis of your use of our website. The information generated is transferred to Google servers, possibly also in the USA. In Google Analytics 4, the truncation of IP addresses is activated by default; your IP address is truncated within the EU/EEA before transfer.

Use takes place exclusively after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and standard contractual clauses. You can additionally prevent collection via the browser add-on for deactivating Google Analytics. Further information: Google's Privacy Policy.

10. Marketing – Meta Pixel

We use the Meta Pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). This allows us to track the behaviour of users after they have been redirected to our website by clicking on a Facebook or Instagram ad, and to measure the effectiveness of our advertisements. Meta may attribute this data to your Facebook/Instagram account and use it for its own advertising purposes in accordance with the Meta Data Policy.

Use takes place exclusively after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Insofar as data is processed jointly with Meta (collection and transfer), this takes place under joint controllership (Art. 26 GDPR). The data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and standard contractual clauses.

11. Newsletter and e-mail marketing – Klaviyo

For sending our newsletter we use Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA). When you sign up for the newsletter, your e-mail address and, where applicable, your name are transmitted to Klaviyo and stored there. Klaviyo analyses the use of the e-mails sent (open rates, click behaviour) in order to improve our offering.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every e-mail or by message to us. In accordance with Section 7(3) UWG, we may send existing customers advertising for similar own products by e-mail; you can object to this at any time without incurring any costs other than the transmission costs according to the basic rates. The data transfer to the USA takes place on the basis of standard contractual clauses. Further information: Klaviyo's Privacy Policy.

12. Other services in our shop

12.1 Judge.me (product reviews)

We use Judge.me (Judge.me Ltd., London, UK) to obtain and display product reviews. Order data (name, e-mail address, purchased product) is transmitted to Judge.me in order to send review requests. The legal basis is our legitimate interest in authentic customer reviews (Art. 6(1)(f) GDPR); for the United Kingdom an adequacy decision by the EU Commission exists. Further information: Judge.me's Privacy Policy.

12.2 Weglot (translation)

For the automatic translation of our shop content we use Weglot (Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France). When translated pages are called up, a connection to Weglot servers is established and your IP address is processed in the process. The legal basis is our legitimate interest in a multilingual offering (Art. 6(1)(f) GDPR). Further information: Weglot's Privacy Policy.

12.3 Fast Bundle (product bundles)

We use the Shopify app Fast Bundle to display and process product bundles. Order-related data is processed in the process. Legal basis: Art. 6(1)(b) and (f) GDPR.

12.4 Attrac (onsite marketing)

We use the Shopify app Attrac for announcement bars and onsite campaigns. Legal basis: Art. 6(1)(f) GDPR.

12.5 Store locator – Stockist

On our store locator page we use the store locator widget of the service Stockist (stockist.co), whose provider is based in the USA. When the page is called up, a connection to Stockist servers is established and your IP address is processed in the process; this involves a transfer to the USA. The legal basis is our legitimate interest in a clear presentation of our points of sale (Art. 6(1)(f) GDPR). Further information: Stockist's Privacy Policy.

13. Merchandise management and processors

To process your order, we process your data in our merchandise management system Odoo (Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium), which acts as a processor for us.

In accordance with Art. 28 GDPR, we use the following processors, with whom corresponding data processing agreements have been concluded:

  • Shopify International Limited – shop system and hosting
  • LSM Fulfillment GmbH – logistics and shipping
  • Odoo S.A. – merchandise management and order processing
  • Klaviyo, Inc. – e-mail marketing
  • Google Ireland Limited – web analytics
  • Meta Platforms Ireland Limited – advertising measurement
  • Stripe Payments Europe, Ltd. – payment processing (Shopify Payments)
  • Judge.me Ltd. – product reviews
  • Weglot SAS – shop translation

14. Contact, right of withdrawal and cancellation function

If you contact us via the contact form, by e-mail (info@finecosmetic.club) or otherwise, we process the data you transmit in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted as soon as your enquiry has been finally dealt with and no statutory retention obligations exist.

Online withdrawal function: If you withdraw from a contract via our withdrawal function („Withdraw from contract“), we process the data you provide there (e.g. name, e-mail address, order details as well as the date and time of receipt) in order to process the withdrawal and to fulfil our legal obligations, in particular to send the confirmation of receipt (Art. 6(1)(b) and (c) GDPR in conjunction with Section 356a BGB). We only collect the data required to process the withdrawal; providing a reason for withdrawal is voluntary.

Online cancellation function: If you cancel a contract via our cancellation function („Cancel contracts here“), we process the data provided there in order to process the cancellation and to send the legally required confirmation of receipt (Art. 6(1)(b) and (c) GDPR in conjunction with Section 312k BGB).

15. International data transfer

The processing of your data may take place in countries outside the EEA, in particular in the USA (Shopify, Klaviyo, Google, Meta, Stockist), Canada (Shopify) and the United Kingdom (Judge.me). The data transfer is safeguarded by: the EU-US Data Privacy Framework (adequacy decision), standard contractual clauses (Art. 46(2)(c) GDPR) as well as adequacy decisions for Canada and the United Kingdom (Art. 45 GDPR).

16. Your rights as a data subject

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent given with effect for the future (Art. 7(3) GDPR)

Right to object: Insofar as we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time for reasons arising from your particular situation. You may object to direct marketing at any time without giving reasons.

To exercise your rights, an e-mail to info@finecosmetic.club is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
www.datenschutz-berlin.de

17. Data security

Our shop uses SSL/TLS encryption (recognisable by „https://“ in the address bar). In addition, we use appropriate technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access.

18. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy in the event of legal, technical or organisational changes. The version published on this page at the relevant time applies.