1. Who is responsible for your data
The controller responsible for data processing on wearonira.com is:
Gerboldt + Thomsen GbR, Steinberg 147, 24107 Kiel, Germany
Email: onirashop@outlook.com
2. Data we collect when you visit our website
When you visit our website, technical data is processed automatically: IP address, date and time of access, pages viewed, browser type, operating system and referring website. We need this data to display the website and to keep it stable and secure. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.
3. Hosting
Our shop is hosted by Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes the data described in this policy on our behalf. Data may also be transferred to Shopify Inc. in Canada and to service providers in the United States. These transfers are protected by an adequacy decision of the European Commission or by standard contractual clauses.
4. Orders and customer accounts
When you place an order, we process your name, billing and delivery address, email address, the items ordered and your payment information. We use this data to process and deliver your order and to handle returns and customer service requests. The legal basis is the performance of a contract under Art. 6(1)(b) GDPR. If you create a customer account, we store your details so you can view your orders and order faster next time. You can ask us to delete your account at any time.
5. Payment
Payments are processed by the following providers, who receive the data needed to carry out the payment:
- Shopify Payments, provided by Shopify International Limited and its payment partners
- PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
We do not store your full card details. The legal basis is Art. 6(1)(b) GDPR.
6. Shipping and tracking
We ship with DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). We pass on your name and delivery address and, where needed for delivery notifications, your email address. You receive tracking information by email and can view the shipping status in our shop. The legal basis is Art. 6(1)(b) GDPR.
7. Email marketing
If you subscribe to our newsletter, we use your email address to send you news and offers from ONIRA. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time by clicking the unsubscribe link in any email or by writing to us.
We send our emails with Klaviyo (Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA). Klaviyo stores your email address and records whether emails are opened and which links are clicked, so we can improve our emails. Klaviyo also uses cookies in our shop to recognise subscribers, where you have consented. Data is transferred to the United States on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.
8. Contacting us
If you contact us by email, we process your message and contact details to answer your request. The legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR.
9. Cookies
We use cookies that are technically necessary to run the shop, for example for the shopping cart and checkout. All other cookies, including those used for analytics and marketing, are only set with your consent, which you give through our cookie banner. You can change or withdraw your consent at any time.
10. How long we keep your data
We keep your data for as long as needed for the purposes described above. Order and invoice data is kept for the retention periods required by German commercial and tax law, which are up to ten years. Newsletter data is kept until you unsubscribe.
11. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing that is based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise your rights, write to onirashop@outlook.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.
12. Providing your data
You are not obliged to provide personal data. Without the data marked as required at checkout, however, we cannot process your order. We do not use automated decision-making or profiling that produces legal effects for you.