Privacy Policy

This Privacy Policy describes how your personal data is collected, used and shared when you visit www.atoliovegas.com (the "Site") or make a purchase from it.

Who we are

The controller responsible for data processing on this Site is:

Atolio Vegas, owner Birhat Shahin Sutthauser Str. 206 49080 Osnabrück Germany Email: support@atoliovegas.de

What data we collect

Device information. When you visit the Site, we automatically collect certain information about your device: browser type, IP address, time zone, language, the pages and products you view, the website or search term that referred you, and how you interact with the Site. This information is collected through cookies, log files, web beacons, tags and pixels.

Order information. When you place an order or attempt to place one, we collect your name, billing address, shipping address, email address, phone number and payment information. Full payment card numbers are processed by the payment provider, not stored by us.

Communication data. When you contact us by email or through a contact form, we process the content of your message and your contact details in order to answer you.

Newsletter data. If you sign up for our newsletter, we store your email address until you unsubscribe. Every newsletter contains an unsubscribe link.

Why we use your data and on which legal basis

Under the EU General Data Protection Regulation (GDPR), every use of personal data needs a legal basis. Ours are:

Performance of a contract, Art. 6 (1) (b) GDPR: processing your order, payment, shipping, order confirmations, customer account, handling returns, warranty and withdrawal cases, and answering your requests before and after a purchase.

Legal obligations, Art. 6 (1) (c) GDPR: retaining order and invoice data under German commercial and tax law.

Legitimate interests, Art. 6 (1) (f) GDPR: screening orders for fraud and risk, ensuring the security and stability of the Site, and defending legal claims. Our legitimate interest is running a secure store and protecting ourselves and our customers from abuse.

Consent, Art. 6 (1) (a) GDPR: analytics and marketing cookies, and the newsletter. You can withdraw consent at any time with effect for the future, for cookies via the cookie settings on the Site, for the newsletter via the unsubscribe link.

Cookies

The Site uses necessary cookies that make the store work (cart, checkout, login, region and language selection). These are set on the basis of our legitimate interest in operating the store.

Analytics and marketing cookies are only set according to your cookie preferences. You can change your preferences at any time via the cookie settings on the Site. More information about cookies in general: www.allaboutcookies.org.

Analytics

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use the Site. Google Analytics uses cookies and similar technologies and processes device information as described above. Data may be transferred to servers of Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/privacy. You can opt out here: tools.google.com/dlpage/gaoptout, or via the cookie settings on the Site.

We also use the Google sales channel for Shopify (Google Merchant Center) so that our products can appear on Google services. This involves the processing of device information as described above.

If we run advertising campaigns in the future, for example on Google or Meta, the related tracking technologies will only be used with your consent, and this policy will be updated to name them.

Who we share data with

We share personal data with service providers that help us run the store, and only as far as needed:

Shopify. Our store is hosted on Shopify. Shopify processes data on our behalf. Details: www.shopify.com/legal/privacy.

Payment providers. When you pay, your payment data goes to the provider you select at checkout (for example PayPal, Klarna, the credit card acquirer or Apple Pay). The provider is responsible for processing your payment data under its own privacy policy.

Shipping carriers. We pass your name, delivery address and, where needed for delivery notifications, your email address or phone number to the carrier delivering your parcel, for example DHL.

We may also disclose personal data to comply with applicable laws, to respond to a lawful request by authorities, or to protect our rights.

We never sell your personal data.

Relationship with Shopify

The Site is hosted by Shopify. Shopify collects and processes personal data about your access to and use of the Site in order to provide and improve the Site for us. Information you submit through the Site is transmitted to and shared with Shopify, and may be processed in countries other than where you live. In addition, we use certain Shopify enhanced features that incorporate data obtained from your interactions with our store, with other merchants and with Shopify. For these features, Shopify is itself responsible for the processing of your personal data, including for responding to requests to exercise your rights over that processing. You can read how Shopify uses personal data in the Shopify Consumer Privacy Policy at www.shopify.com/legal/privacy/app-users, and depending on where you live you can exercise certain rights directly at privacy.shopify.com.

Transfers outside the EU

Some of our service providers process data outside the European Economic Area, in particular in the USA and Canada. Where this happens, the transfer is protected by an adequacy decision of the European Commission (for Canada and for US companies certified under the EU-U.S. Data Privacy Framework) or by the EU Standard Contractual Clauses.

How long we keep your data

Order and invoice data is kept for the retention periods of German commercial and tax law, up to 10 years. Communication data is kept as long as needed to handle your request and any follow-up. Newsletter data is kept until you unsubscribe. Device information collected for analytics is kept for a maximum of 14 months. Where no retention obligation applies, we delete personal data on request.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), the right to data portability (Art. 20), and the right to withdraw any consent at any time with effect for the future (Art. 7 (3)).

You also have the right to object, Art. 21 GDPR: where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. Where data is used for direct marketing, you can object at any time without giving reasons.

To exercise any of these rights, email support@atoliovegas.de. In addition, you have the right to lodge a complaint with a data protection supervisory authority, for example the authority of your place of residence or the authority responsible for us, the Landesbeauftragte für den Datenschutz Niedersachsen, Germany.

If you are outside the EEA and the UK, we apply the same standards to your data, and the rights of your local data protection law remain unaffected.

Minors

The Site is not intended for persons under the age of 18.

Changes

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal or regulatory reasons. The current version is always available on this page.

Contact

For questions about this Privacy Policy or our data practices, or to make a complaint, contact us at support@atoliovegas.de or by mail:

Atolio Vegas Sutthauser Str. 206 49080 Osnabrück Germany