Privacy policy

Privacy Policy

Last updated: 2 August 2026

1. Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Mamas Süßigkeiten | Anton Pyneshchenko
Georg-Schumann-Straße 100
04155 Leipzig
Germany

Telephone: +49 152 37808213
Email: info@mamaskaffee.com

A data protection officer has not been appointed because there is currently no legal obligation to appoint one.

2. General information about data processing

We process personal data only where necessary to operate our online shop, process orders and enquiries, comply with legal obligations, or on the basis of consent or a legitimate interest.

Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, names, addresses, email addresses, telephone numbers, order data, payment information, IP addresses and information about the use of our website.

Processing is carried out, in particular, on the following legal bases:

  • Article 6(1)(a) GDPR - consent;

  • Article 6(1)(b) GDPR - performance of a contract and pre-contractual measures;

  • Article 6(1)(c) GDPR - compliance with legal obligations;

  • Article 6(1)(f) GDPR - pursuit of legitimate interests.

When information is stored on or accessed from your device, we also comply with the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Provision of the website and server log files

When you access our website, technically necessary information may be processed automatically. This includes, in particular:

  • IP address;

  • date and time of access;

  • page or file accessed;

  • amount of data transferred;

  • referring URL;

  • browser type and version;

  • operating system;

  • device information;

  • HTTP status code.

Processing is necessary to make the website technically available, ensure its stability and security, detect errors, and prevent abusive or fraudulent access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and economically efficient operation of our online shop.

Technical log data is deleted once it is no longer required for these purposes, unless longer storage is necessary due to a specific security incident or legal obligation.

4. Shopify

Our online shop is operated using the Shopify platform. The provider generally responsible for merchants in the European Economic Area is:

Shopify International Limited
Ireland

Shopify provides us with functions including:

  • hosting of the online shop;

  • shopping cart and order processing;

  • customer accounts;

  • payment and checkout functions;

  • fraud prevention;

  • technical security;

  • shop analytics;

  • consent and cookie management;

  • communication and email functions;

  • management of products, orders and customer data.

The data processed may include contact details, order data, payment information, device information, IP addresses, usage data and communication data.

Depending on the purpose, processing is based on Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f) GDPR. Where Shopify functions are used for analytics, advertising or personalisation, processing is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Shopify may use affiliated companies and subcontractors outside the European Economic Area. According to Shopify, recognised transfer mechanisms are used, including binding corporate rules, adequacy decisions and standard contractual clauses.

Further information:

https://www.shopify.com/legal/privacy/consumers
https://www.shopify.com/legal/privacy

5. Orders, customer accounts and contract processing

If you place an order or create a customer account, we process, in particular:

  • first and last name;

  • billing and delivery address;

  • email address;

  • telephone number;

  • customer and order number;

  • products ordered;

  • prices and discounts;

  • payment status and selected payment method;

  • shipping and tracking data;

  • return, withdrawal and complaint information;

  • customer account details;

  • order-related communications.

Processing takes place to initiate, perform and manage the contract, including payment, delivery, customer service, returns and warranty claims.

The legal basis is Article 6(1)(b) GDPR. Where we must retain information to comply with tax, commercial or other legal obligations, the legal basis is Article 6(1)(c) GDPR.

The information marked as mandatory must be provided to process an order. Without this information, we cannot enter into or perform the contract.

Creating a customer account is voluntary. You may request deletion of your customer account at any time. We may continue to store order and accounting data that is subject to statutory retention obligations after the account has been deleted.

6. Payment service providers

For payment processing, we transfer the required information to the payment service provider selected by you. This may include your name, address, email address, order value, currency, payment information, IP address and fraud-prevention information.

The legal basis is Article 6(1)(b) GDPR. Where data is processed for fraud prevention, processing may additionally be based on Article 6(1)(f) GDPR.

Depending on the payment method selected during checkout, the following providers may be used.

6.1 Shopify Payments

Shopify Payments is used within the Shopify platform to process card payments and other payment methods. Shopify and the payment service providers engaged by Shopify may process the payment and transaction data required for this purpose.

Further information:

https://www.shopify.com/legal/privacy

6.2 PayPal

Provider:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg

PayPal processes payment, account, device and transaction data under its own data protection responsibility.

Further information:

https://www.paypal.com/de/legalhub/paypal/privacy-full

6.3 Klarna

Provider:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Klarna may process personal data for payment processing, identity verification, credit checks, fraud prevention and management of the selected payment method.

Further information:

https://www.klarna.com/international/privacy-policy/

6.4 Apple Pay

If you select Apple Pay, payment information is processed by Apple and the payment service providers involved. As a rule, we receive only the payment and confirmation information necessary to process the order.

Further information:

https://www.apple.com/legal/privacy/

6.5 Google Pay

If you select Google Pay, payment information is processed by Google and the payment service providers involved. As a rule, we receive only the payment and confirmation information necessary to process the order.

Further information:

https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice

7. Shipping and shipment tracking

To deliver your order, we transfer the information required for shipping to the relevant delivery provider. This includes, in particular, your name, delivery address and, where applicable, your email address, telephone number, order details and tracking information.

The legal basis is Article 6(1)(b) GDPR.

Your email address and telephone number are transferred to a delivery provider only where this is necessary for delivery, you have consented to the transfer, or the transfer is legally permissible and required to pursue our legitimate interest in reliable delivery.

7.1 DHL

We may use the following provider for shipping:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Further information:

https://www.dhl.de/datenschutz

7.2 DPD

We may use the following provider for shipping:

DPD Deutschland GmbH
Wailandtstraße 1
63741 Aschaffenburg
Germany

Further information:

https://www.dpd.com/de/en/data-protection/

7.3 easyDPD

We may use the Shopify application easyDPD to create shipping labels, transmit shipping information and process DPD shipments.

The recipient, order and shipment data required for shipping may be processed. The legal basis is Article 6(1)(b) GDPR.

7.4 CWILL Parcel Panel

We use CWILL Parcel Panel, formerly Parcel Panel or ParcelWILL, to provide shipment tracking, display shipping status, communicate shipping updates and, where applicable, offer additional shipping protection.

The information processed may include the order number, tracking number, shipping status, name, contact details, delivery address, products ordered, device information and IP address.

Processing required to provide shipment tracking and manage selected shipping protection is based on Article 6(1)(b) GDPR. Where processing is used to improve our shipping service, detect delivery problems or maintain technical security, it is based on Article 6(1)(f) GDPR.

Non-essential analytics, personalisation and marketing functions are used only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Further information:

https://www.parcelpanel.com/privacy-policy/

8. Contact and customer service

If you contact us by email, telephone, contact form or messaging service, we process the information provided by you. This may include your name, email address, telephone number, order number and the contents of your message.

Where your enquiry relates to an existing or proposed contract, processing is based on Article 6(1)(b) GDPR.

Other enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in processing your enquiry and communicating with you.

Information may be retained for longer where statutory retention obligations apply or where it is required to establish, exercise or defend legal claims.

9. Newsletter and email marketing

If you subscribe to our newsletter, we process, in particular:

  • email address;

  • name, where provided;

  • time of registration;

  • consent status;

  • proof of consent;

  • IP address at the time of registration;

  • delivery information;

  • opening and click rates, where you have consented to this;

  • unsubscribe and withdrawal information.

Registration generally uses a double opt-in procedure. You will receive an email asking you to confirm your subscription. This is used to verify that the registration was actually requested by the owner of the email address.

The legal basis for sending the newsletter and for consent-based performance measurement is Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link in each marketing email or by contacting info@mamaskaffee.com.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

After unsubscribing, your email address may be stored on a suppression list to ensure that no further marketing emails are sent. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in respecting your withdrawal and defending against unjustified claims.

Where the requirements of Section 7(3) of the German Unfair Competition Act (UWG) are met, we may inform existing customers by email about our own similar products. You may object to this use at any time without incurring costs other than the basic transmission costs.

9.1 Shopify Email

We may use Shopify Email to create, send and evaluate newsletters. Newsletter and recipient data is processed within the Shopify platform.

Further information:

https://www.shopify.com/legal/privacy

9.2 Seguno Email

We may also use Seguno Email for newsletters, automated emails, abandoned-cart reminders and technical evaluation of email campaigns.

The provider is Seguno Software. Seguno processes the recipient, campaign, order and usage information required within its Shopify integration.

According to Seguno, Shopify manages the record of newsletter consent and provides Seguno with the information required for delivery.

Further information:

https://www.seguno.com/privacy

10. Product reviews using Ryviu

We use Ryviu Product Reviews to display, collect and manage product reviews and, where applicable, product questions.

If you submit a review or question, the following information may be processed:

  • name or selected display name;

  • email address;

  • contents of the review or question;

  • rating;

  • images or other voluntarily provided content;

  • related product and order information;

  • IP address;

  • device, browser and usage information.

Processing is based on your consent under Article 6(1)(a) GDPR or on Article 6(1)(b) GDPR for the provision of the review function requested by you.

Published reviews may contain the display name selected by you and the content you voluntarily provide. Your email address will not be displayed publicly.

Requests to submit reviews will be sent only where consent has been provided or the statutory requirements for such a message are met.

Ryviu may process information in third countries. Where required, transfers take place on the basis of appropriate safeguards under Articles 44 et seq. GDPR.

Further information:

https://www.ryviu.com/privacy-policy

11. Search, translation and personalisation functions

11.1 Shopify Search & Discovery

We use Shopify Search & Discovery to improve product searches, filters, product recommendations and the discoverability of content.

Search terms, products viewed, interactions and technical usage information may be processed.

Where processing is necessary to provide a search function requested by the user, it is based on Article 6(1)(b) GDPR. Additional analytics or personalisation is based on your consent under Article 6(1)(a) GDPR where consent is required.

11.2 Translate & Adapt and Hextom Translate and Currency

We use Shopify Translate & Adapt and, where applicable, Hextom Translate and Currency to display content in several languages and provide country and currency settings.

The information processed may include language preferences, country, selected currency, IP address and technical device information.

Technically necessary language and country settings are processed on the basis of Article 6(1)(f) GDPR and Section 25(2) TDDDG. Non-essential analytics or permanent personalisation is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

12. UserWay widget

We use a UserWay widget to improve the accessibility and usability of our website.

When the widget is loaded or used, technical information such as the IP address, device and browser information, and information about the use of the widget may be processed and transferred to UserWay.

Where the widget is not technically essential, it is loaded only after your consent. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Further information:

https://userway.org/privacy/

13. Protection against misuse and hCaptcha

Shopify may use hCaptcha to protect forms, logins and other functions against automated access, spam, fraud and misuse.

Provider:

Intuition Machines, Inc.
USA

The information processed may include the IP address, device and browser information, mouse movements, input behaviour and technical usage information.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, customer accounts and forms against abusive or automated use.

Access to technically necessary information on the user’s device is based on Section 25(2) TDDDG.

Further information:

https://www.hcaptcha.com/privacy

14. Cookies and consent management

Our website uses cookies and similar technologies. These are small pieces of information stored on or accessed from your device.

We distinguish, in particular, between the following categories.

14.1 Technically necessary cookies

These cookies are required to provide essential online-shop functions, including:

  • shopping cart;

  • checkout;

  • login and customer account;

  • language and security settings;

  • fraud prevention;

  • storage of your privacy preferences;

  • load balancing and technical stability.

Storage or access is based on Section 25(2) TDDDG. The related processing of personal data is based, depending on the purpose, on Article 6(1)(b) or Article 6(1)(f) GDPR.

14.2 Analytics, marketing and personalisation cookies

These technologies are used for audience measurement, analysis of user behaviour, measurement of advertising effectiveness, personalisation and interest-based advertising.

They are used only with your prior consent.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

14.3 Managing and withdrawing consent

When you first visit our website, you can use the cookie banner to decide which non-essential processing activities you accept.

Your consent is voluntary and may be changed or withdrawn at any time with effect for the future using the “Privacy settings” link in the footer of our website.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

15. Meta Pixel, Facebook and Instagram

With your consent, we use the Meta Pixel and server-side and browser-side measurement functions provided by Meta.

Provider:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

These functions may be used to:

  • measure visits and interactions on our website;

  • record orders and other conversion events;

  • analyse the effectiveness of advertising;

  • create advertising audiences;

  • display interest-based advertising on Facebook and Instagram;

  • transmit event data through the Meta Conversions API.

The information processed may include IP address, device information, browser data, cookie identifiers, pages viewed, products, shopping-cart and purchase events, order value and hashed contact details.

Processing takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Meta may process information in the United States and other third countries. Where required, Meta relies on an adequacy decision or other appropriate safeguards.

Further information:

https://www.facebook.com/privacy/policy/

16. Google Analytics, Google Ads and Google & YouTube

With your consent, we use services provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

These services may include Google Analytics, Google Ads, conversion tracking, remarketing and the Shopify Google & YouTube application.

The services may be used to:

  • evaluate the use of our website;

  • measure reach and visitor sources;

  • identify technical errors;

  • record orders and other conversion events;

  • measure the effectiveness of advertisements;

  • create audiences for interest-based advertising;

  • display products through Google and YouTube;

  • transmit event data on the server side and browser side.

The information processed may include IP address, device and browser information, cookie identifiers, approximate location information, pages viewed, search terms, product interactions, shopping-cart and purchase events and order values.

Processing takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Google may also process information through Google LLC in the United States and through other affiliated companies and processors. Where required, the transfer is based on an adequacy decision or appropriate safeguards.

Further information:

https://policies.google.com/privacy
https://policies.google.com/technologies/partner-sites

17. TikTok Pixel

With your consent, we use the TikTok Pixel and server-side and browser-side event functions provided by:

TikTok Technology Limited
10 Earlsfort Terrace
Dublin 2, D02 T380
Ireland

These services may be used to:

  • record visits and interactions on our website;

  • measure orders and conversion events;

  • analyse the effectiveness of TikTok advertising;

  • create advertising audiences;

  • display interest-based advertisements;

  • transmit event data to TikTok on the server side.

The information processed may include IP address, device information, browser data, cookie and advertising identifiers, pages viewed, product interactions, shopping-cart and purchase events, order values and, where applicable, hashed contact details.

Processing takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

TikTok may process information outside the European Economic Area or permit access from third countries. Where required, appropriate safeguards under Articles 44 et seq. GDPR are used.

Further information:

https://www.tiktok.com/legal/page/eea/privacy-policy/en

18. Nitro Upsell & Cross Sell

We use Nitro Upsell & Cross Sell to provide product recommendations, bundles, discount promotions, shopping-cart offers and other functions intended to improve the shopping experience.

The information processed may include products viewed, shopping-cart contents, order events, interactions with offers, device information, IP address and cookie identifiers.

Where processing is required only to display a shop function requested by the user, it is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly and economically efficient design of our services.

Analytics, tracking and personalisation functions of the Nitro Pixel are used only with your consent. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

19. Smart SEO

We use Smart SEO for technical search-engine optimisation, creation of metadata and provision of structured product and company data to search engines.

Where no personal visitor information is processed, the GDPR does not apply. If technical usage information is processed, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the discoverability and technically correct presentation of our online shop.

20. Social media links

Our website contains links to our profiles on social networks, such as Instagram, TikTok and other platforms.

If these are ordinary links, no information is transferred to the relevant platform merely because you visit our website. A connection to the platform is established only when you click the link. The respective platform provider is generally responsible for the subsequent processing.

21. Retention periods

We store personal data only for as long as required for the relevant purpose or as long as statutory retention obligations apply.

The following general principles apply:

  • order, contract and accounting data is generally retained for up to eight or six years in accordance with applicable tax and commercial-law requirements;

  • information required to establish or defend civil-law claims may generally be retained until the applicable statutory limitation period expires;

  • customer-account information is generally retained until the account is deleted, unless statutory retention obligations require continued storage;

  • enquiries are deleted after processing has been completed where there is no statutory or legitimate reason for further storage;

  • newsletter information is retained until consent is withdrawn;

  • evidence of consent or withdrawal may be retained to comply with legal accountability obligations and defend against claims;

  • cookie and tracking information is retained for the period stated in the cookie banner or by the relevant service.

After the applicable periods expire, the information is deleted or anonymised unless another legal basis permits further storage.

22. Recipients of personal data

Where necessary, personal data may be transferred, in particular, to the following categories of recipients:

  • shop and hosting providers;

  • payment service providers and banks;

  • shipping and logistics providers;

  • shipment-tracking providers;

  • IT, security and support providers;

  • newsletter and communication providers;

  • analytics and advertising providers;

  • review and marketing providers;

  • tax advisers, legal advisers and other professionally bound advisers;

  • public authorities and courts where required by law.

We do not disclose personal data to third parties without a legal basis.

23. Transfers to third countries

Some of our service providers or their subprocessors are located outside the European Economic Area or allow access to information from third countries.

Transfers take place only where the requirements of Articles 44 et seq. GDPR are met. Transfer mechanisms may include:

  • adequacy decisions of the European Commission;

  • the EU-US Data Privacy Framework, where the recipient is appropriately certified;

  • standard contractual clauses issued by the European Commission;

  • binding corporate rules;

  • other legally recognised safeguards.

Despite these safeguards, it cannot be completely ruled out that public authorities in the United States or other third countries may access information under applicable national law.

24. Automated decision-making

As a general rule, we do not carry out decision-making based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR.

Payment service providers may use their own automated procedures for fraud, identity or credit checks. The privacy information of the respective payment provider additionally applies to these procedures.

25. Data security

We take appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access and unlawful disclosure.

Our website uses an encrypted HTTPS connection. Payment information is generally processed directly by the payment service providers used.

Please note that the transmission of information over the internet is not completely risk-free and absolute protection cannot be guaranteed.

26. Your rights

Subject to the applicable statutory requirements, you have the following rights:

  • right of access under Article 15 GDPR;

  • right to rectification under Article 16 GDPR;

  • right to erasure under Article 17 GDPR;

  • right to restriction of processing under Article 18 GDPR;

  • right to data portability under Article 20 GDPR;

  • right to object under Article 21 GDPR;

  • right to withdraw consent under Article 7(3) GDPR;

  • right to lodge a complaint with a supervisory authority under Article 77 GDPR.

To exercise your rights, contact us at info@mamaskaffee.com.

Right to object

Where we process personal data on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object at any time and without giving reasons. Following your objection, your information will no longer be used for direct marketing.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

27. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The authority responsible for our registered place of business is:

Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 5
01067 Dresden
Germany

Website:

https://www.datenschutz.sachsen.de/

You may also contact a supervisory authority at your habitual place of residence, your place of work or the place of the alleged data protection infringement.

28. Children’s data

Our online shop is not specifically directed at children. We do not knowingly collect personal data from children without the required consent of their legal representatives.

If you believe that a child’s personal data has been provided to us unlawfully, please contact us at info@mamaskaffee.com.

29. Amendments to this Privacy Policy

We may amend this Privacy Policy if our website, the services used, our data-processing activities or the applicable legal requirements change.

The current version is available on this website. The date at the beginning shows when the Privacy Policy was last updated.