Privacy policy

ANNARELLE GmbH - As of: August 3, 2026. This English translation is provided for convenience. The German version (Datenschutzerklärung) is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

ANNARELLE GmbH
Südliche Münchner Str. 42A
82031 Grünwald, Germany
Represented by: Beatrice Walden (Managing Partner)
Phone: +49 89 38168383-0
Email: store@annarelle.com

A data protection officer has not been appointed, as the legal requirements for a mandatory appointment are not met.

2. Overview

We process personal data only to the extent necessary to operate our online shop, to process orders and - with your consent - for analytics and marketing. Depending on the processing, the legal bases are:

  • Art. 6 (1)(b) GDPR (performance of a contract: orders, delivery, customer account, invoices)
  • Art. 6 (1)(c) GDPR (legal obligations: retention under commercial and tax law)
  • Art. 6 (1)(f) GDPR (legitimate interests: technical operation, security, fraud prevention)
  • Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act) (consent: cookies and similar technologies for analytics and marketing, newsletter)

You can revoke any consent you have given at any time with effect for the future (Art. 7 (3) GDPR), for cookies via the cookie settings (section 7), for the newsletter via the unsubscribe link in every email.

3. Shop Platform and Hosting (Shopify)

Our online shop is operated on the e-commerce platform Shopify (Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland; part of Shopify Inc., Canada). Shopify processes on our behalf all data required to operate the shop (order, account, payment and access data) on the basis of a data processing agreement (Art. 28 GDPR). According to Shopify, shop data for European merchants is stored primarily in the European Union; to the extent that data is transferred to third countries (in particular Canada and the USA) in the context of support, group functions or sub-processors, this takes place under the Shopify data processing agreement on the basis of the adequacy decision for Canada, the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

We also use the Shopify service "Network Intelligence": data from our shop is backed up and used in aggregated form together with data from other Shopify shops to improve product recommendations, ad targeting and the personalization of our shop. Other merchants cannot view your data in this process. Legal basis: Art. 6 (1)(f) GDPR (improvement of our offering); you can object to this processing at any time (section 16).

When you visit our website, server log data is processed automatically (IP address, date and time, page accessed, browser type, referrer). The legal basis is Art. 6 (1)(f) GDPR (technical operation and security). The transmission is TLS-encrypted.

4. Order Processing and Payment Service Providers

To process your order, we process your order, address and payment data (Art. 6 (1)(b) GDPR). Depending on the payment method selected, payment data is transmitted directly to the respective payment service provider:

  • Shopify Payments (credit cards: Visa, Mastercard, American Express; Apple Pay; Google Pay; Shop Pay) - Shopify International Limited, Ireland
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg - including the installment payment options offered by PayPal; if you use them, PayPal performs its own credit check
  • Klarna Bank AB (publ), Sweden - for Klarna payment methods (including pay-by-invoice and installment purchase), we transmit the data required for processing; Klarna performs credit and identity checks for financing offers on its own responsibility (transmission to credit agencies); details, legal bases and storage periods can be found in Klarna's privacy notices

Financing and installment payment contracts are concluded exclusively between you and the respective provider; the provider is an independent controller for the associated data processing.

The payment service providers are in part independent controllers for payment processing.

5. Shipping and Transport Insurance

For delivery, we transmit your name and delivery address to our shipping carrier DHL (Deutsche Post AG and DHL Paket GmbH, Bonn - DHL Group; domestic German parcels: DHL Paket GmbH, international shipments: Deutsche Post AG). Legal basis: Art. 6 (1)(b) GDPR. We pass your email address or phone number on to the shipping carrier for the purpose of shipping notifications (e.g. announcement of the delivery date) only with your consent (Art. 6 (1)(a) GDPR); this consent is voluntary, and without it we transmit only your name and address, and delivery is not affected.

Our shipments are additionally covered by transport insurance through Claisy (brand name of TRCKLY SASU, 4 Rue du Rendez-Vous, 75012 Paris, France; insurance intermediary, ORIAS No. 24 004 545). For this purpose, we transmit shipment data (tracking number, value of the goods, recipient data) to Claisy. Legal bases: Art. 6 (1)(b) and (f) GDPR (safeguarding the delivery). Claisy processes the data within the EU.

6. Customer Account, Customer Portal and Invoices

You can create a customer account (Shopify) for your orders. Via our customer portal my.annarelle.com, you can register returns and retrieve your invoices; you sign in with your Shopify customer account. We run our invoice processing on Google Cloud (Google Cloud EMEA Limited, Ireland) in the Frankfurt am Main region (europe-west3) on the basis of a data processing agreement. We retain invoice data in accordance with commercial and tax law requirements (section 14). Legal bases: Art. 6 (1)(b) and (c) GDPR.

7. Cookies and Consent Management

We use cookies and similar technologies. We use technically necessary cookies (e.g. shopping cart, login, consent status) on the basis of § 25 (2) TDDDG and Art. 6 (1)(f) GDPR. We use all non-essential cookies (analytics, marketing - sections 8 to 11) only with your consent (§ 25 (1) TDDDG, Art. 6 (1)(a) GDPR).

You give and manage your consent via the cookie banner (Shopify Customer Privacy). You can change or revoke your selection at any time via the "Cookie settings" link in the footer.

8. Google Analytics 4

With your consent, we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Purpose: reach and usage analysis of the shop (e.g. page views, product views, cart and purchase events). Google Analytics uses cookies and similar technologies; according to Google, IP addresses are not logged or stored by Google Analytics 4, and analysis is performed using truncated/aggregated location data. For transfers to the USA, Google relies on the EU-US Data Privacy Framework (certification of Google LLC) as well as Standard Contractual Clauses. Storage period for analytics data: 14 months (configured by us). Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG; you can revoke your consent at any time via the cookie settings.

9. Meta Pixel (Facebook/Instagram)

With your consent, we use the Meta Pixel (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; parent company Meta Platforms Inc., USA). Purpose: measurement and optimization of our advertising on Facebook and Instagram (conversion measurement, audience building/retargeting). Event data (e.g. page views, purchases) and online identifiers are transmitted to Meta; for the collection and transmission of this data, we are jointly responsible with Meta (Art. 26 GDPR); the agreement is available from Meta. Transfers to the USA are based on the EU-US Data Privacy Framework (certification of Meta Platforms Inc.) as well as Standard Contractual Clauses. The storage period depends on the lifetimes of the cookies used and the periods configured with Meta; general principles in section 14. Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG; you can revoke your consent at any time via the cookie settings.

10. Pinterest Tag

With your consent, we use the Pinterest Tag (provider: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland; parent company Pinterest Inc., USA). Purpose: conversion measurement and optimization of our Pinterest ads. Transfers to the USA are based on the EU-US Data Privacy Framework (certification of Pinterest, Inc.) as well as Standard Contractual Clauses. The storage period depends on the lifetimes of the cookies used and the periods configured with Pinterest; general principles in section 14. Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG; you can revoke your consent at any time via the cookie settings.

11. Klaviyo (Email Marketing and Onsite Tracking)

With your consent, we use Klaviyo (provider: Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA) for our newsletter and - likewise only with consent - for attributing shop events (e.g. "added to cart") to newsletter profiles. Transfers to the USA are based on the EU-US Data Privacy Framework (certification of Klaviyo, Inc.) as well as the EU Standard Contractual Clauses; a data processing agreement is in place with Klaviyo. We store newsletter profile data until you revoke your consent or unsubscribe; we retain the records of consent beyond that for evidentiary purposes. Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG. Onsite tracking is loaded only after you have given marketing consent via the cookie banner.

12. Newsletter (Double Opt-In)

For sending the newsletter, we process your email address and, optionally, your name. Sign-up uses the double opt-in procedure: after registering, you receive a confirmation email; your sign-up only becomes effective when you click the confirmation link. We log the sign-up and confirmation (timestamp, IP address) in order to be able to prove consent (Art. 7 (1) GDPR, § 7 (2) no. 2 UWG (German Act Against Unfair Competition)). Legal basis: Art. 6 (1)(a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email; your consent lapses with effect for the future. For performance measurement (open/click rates), see section 11.

13. Contact, Telephony and Online Consultations

When you contact us by email, contact form or phone, we process the information you provide in order to handle your inquiry (Art. 6 (1)(b) or (f) GDPR). We operate our telephony via sipgate (sipgate GmbH, Gladbacher Str. 74, 40219 Düsseldorf); connection data is generated in the process. We delete inquiry data once the inquiry has been conclusively handled and no retention obligations stand in the way.

Email system: We operate our business email via Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on the basis of a data processing agreement; the European Union is configured as the data region. To the extent that data reaches third countries in the context of support or group functions, the safeguards of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses apply.

WhatsApp: You can also contact us via WhatsApp (WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). WhatsApp processes communication content and metadata in accordance with its own privacy policies, including in third countries. Use is voluntary - you can equally address all matters to us by email or phone. Legal basis for our processing: Art. 6 (1)(b) or (f) GDPR.

Online consultation appointments: Where we offer consultation appointments by video call (Google Meet or WhatsApp video call), we process your appointment and contact data to conduct the appointment (Art. 6 (1)(b) GDPR). Calls are not recorded.

14. Storage Periods

We store personal data only for as long as necessary for the respective purpose. In detail, the following criteria apply:

  • Contract and order data is stored for the duration of contract processing and thereafter within the scope of the retention obligations under commercial and tax law (§§ 147 AO, 257 HGB (German Fiscal Code / Commercial Code)).
  • Inquiry data (contact, consultations) is deleted after the inquiry has been conclusively handled, unless retention obligations or limitation periods stand in the way.
  • Consent-based data (newsletter, cookies) is processed until you revoke your consent; we retain the records of consent beyond that for documentation purposes.
  • Data from analytics and marketing services (sections 8 to 11) depends on the lifetimes of the respective cookies and the periods configured with the provider (Google Analytics: 14 months).

After that, the data is deleted.

15. Social Media Profiles

We maintain profiles on Instagram and Facebook (Meta Platforms Ireland Limited), Pinterest (Pinterest Europe Limited), YouTube (Google Ireland Limited) and can be reached via WhatsApp (WhatsApp Ireland Limited). When you visit these profiles, the respective provider processes your data on its own responsibility; for the insights data collected there, joint responsibility exists in part (Art. 26 GDPR). For details, please refer to the providers' privacy notices.

16. Your Rights

You have the following rights against us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1)(f) GDPR. You can object to direct marketing at any time without giving reasons.
  • Right to revoke consent you have given (Art. 7 (3) GDPR) with effect for the future

To exercise these rights, an informal message to store@annarelle.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

17. Changes to This Privacy Policy

We update this Privacy Policy when our processing operations or the legal situation change. The version published here at the relevant time applies.