1. Data We Collect

1. Data We Collect

1.1 Personal Data

• Order Information: Name, shipping address, email, phone number, payment details

• Verification Data: Age verification documents (to comply with legal requirements for e-cigarette products)

• Device Information: IP address, browser type, device identifiers

1.2 Automatic Data Collection

• Cookies for cart functionality and storing user preferences

• Analytics data via Google Analytics (anonymized where possible)

---

2. Legal Basis for Processing (GDPR-Compliant)

• Contract Fulfillment: Processing is necessary for completing orders

• Legal Obligation: Age verification when selling e-cigarettes

• Consent: For marketing purposes (only with explicit approval)

---

3. Data Sharing

• Service Providers: Payment processors (e.g., Stripe, PayPal), logistics partners (e.g., DHL, FedEx)

• Legal Requirements: When required by German or EU law

• Third Parties: Only with the explicit consent of the user

We never sell customer data.

---

4. International Data Transfers

We generally process your data within the EU. Transfers to third countries only occur based on GDPR-compliant standard contractual clauses.

---

5. Data Retention

• Order data: 10 years (in accordance with German retention requirements)

• Age verification: 3 years (legal requirements for e-cigarette products)

• Marketing consents: Until revoked

---

6. Your Rights under GDPR

• Access to your stored data / data portability

• Correction of inaccurate data

• Deletion of your data (“Right to be Forgotten”)

• Restriction of processing

• Objection to processing

• Withdrawal of your consent (e.g., for marketing)

---

7. Age Verification

We enforce strict age verification to prevent sales to minors – in accordance with §10 JuSchG (German Youth Protection Act).

---

8. Security Measures

• SSL encryption for all data transfers

• Payment processing in compliance with PCI-DSS standards

• Regular security audits

---

9. Changes to This Policy

Changes to this Privacy Policy will be announced at least 30 days in advance via email or website banner.

---

10. Contact

Data Protection Officer
Email: support@shop-upends.com

For EU residents:
You have the right to file a complaint with your competent data protection authority.