Privacy Policy

 

2. General Information on Data Processing

​

Personal data means any information relating to an identified or identifiable natural person. Examples include name, address, telephone number, email address and IP address.

​

I process personal data only where necessary to provide this website, handle enquiries, carry out and fulfil orders, comply with legal obligations, or where you have consented to the processing.

Depending on the purpose, processing is based in particular on Article 6(1)(a), (b), (c) or (f) GDPR.

​

3. Website Hosting (Wix)

​

This website is provided through the Wix platform. The provider is:

​

Wix.com Ltd.
40 Namal Tel Aviv St.
Tel Aviv 6350671
Israel

​

Wix provides the technical infrastructure, web hosting, security features and shop platform. When you visit this website, Wix processes technical data required for its operation and security. This may include your IP address, access date and time, browser type and version, operating system, referrer URL, pages visited, device information and language settings.

​

This processing serves in particular to provide the website and ensure its secure, reliable operation. The legal basis is Article 6(1)(f) GDPR.

​

Wix processes personal data on my behalf. A data processing agreement under Article 28 GDPR is in place for this purpose.

​

When Wix is used, personal data may also be processed outside the European Union or European Economic Area. According to Wix, it uses appropriate safeguards in accordance with GDPR requirements.

​

Further information about Wix’s data processing can be found in Wix’s privacy notices.

 

4. Server Log Files

​

When you access this website, technical information is collected automatically and stored in server log files. This may include:

​

• IP address
• Access date and time
• Browser type and version
• Operating system
• Pages visited
• Referrer URL
• Volume of data transferred
• Server status code

​

This data is processed to ensure the website operates reliably and securely, and to detect and prevent attacks.

 

The legal basis is Article 6(1)(f) GDPR.

​

Server log files are stored only for as long as necessary for these purposes and then deleted, unless statutory retention obligations require otherwise.

 

5. SSL/TLS Encryption

​

For security reasons, this website uses SSL/TLS encryption. Data transmitted between your browser and this website is therefore encrypted and protected against unauthorised access.

​

One way to recognise an encrypted connection is that your browser’s address bar begins with ‘https://’.

 

6. Cookies and Consent Management

​

This website uses cookies and similar technologies. Some are technically necessary for the website and online shop to function properly. Other technologies are used only with your prior consent.

​

I use Usercentrics for Wix to manage your consent. The cookie banner allows you to choose which non-essential technologies you consent to or to reject them.

​

You can change or withdraw your consent at any time with effect for the future using the Cookie Settings available on the website.

​

Where consent is required, processing is based on Article 6(1)(a) GDPR. Technically necessary processing is based on the applicable legal provisions.

​

Further information about the cookies and similar technologies used can be found in this website’s Cookie Policy.

 

7. Contact via Contact Form or Email

​

If you contact me using the contact form or by email, I process the personal data you provide to handle your enquiry. This may include your name, email address, a telephone number provided voluntarily, your message and any files submitted.

​

For enquiries about delivery to other countries, I also process details of your chosen product and destination where necessary to check delivery availability, shipping costs and delivery time, and to prepare an individual offer.

​

Where your enquiry relates to entering into or performing a contract, processing is based on Article 6(1)(b) GDPR. In other cases, it is based on Article 6(1)(f) GDPR. My legitimate interest is to handle and respond to your enquiry.

​

The data is deleted once it is no longer required to handle your enquiry, unless statutory retention obligations or other legal grounds require continued storage. If your enquiry leads to an order, the information on processing and storing order data also applies.

​

8. Communication via WhatsApp

​

You can contact me via WhatsApp. If you use this channel, I process the personal data you provide to handle your enquiry. This may include your telephone number, name or WhatsApp display name, messages, files and images you send.

​

WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

​

When WhatsApp is used, WhatsApp may process personal data. This may include transferring data to third countries.

​

Where your enquiry relates to entering into or performing a contract, my processing is based on Article 6(1)(b) GDPR. In other cases, it is based on Article 6(1)(f) GDPR and my legitimate interest in simple, prompt communication.

​

Further information on WhatsApp’s processing of personal data is available in WhatsApp’s privacy notices.

 

9. Orders through Our Online Shop or following an Individual Enquiry

​

If you order through my online shop or by email following an enquiry, I process the personal data required for the order and performance of the contract. This may include:

​

• First and last name;

• Billing and delivery address, including destination country;

• Email address;

• Telephone number, where required to fulfil the order or provided voluntarily;

• Order and product details, including your personalisation requests;

• Payment and shipping information;

• Information required for customs clearance for cross-border deliveries.

 

Processing is carried out to handle your order, make the products ordered, process payment, issue invoices, ship the goods and handle any queries or complaints. The legal basis is Article 6(1)(b) GDPR.

Where statutory retention, documentation or reporting obligations apply, the processing required for these purposes is based on Article 6(1)(c) GDPR.

​

Payment and shipping providers receive the data necessary to perform the contract. For international deliveries, customs service providers and relevant authorities may also receive necessary data. Further information is provided in the sections on payment processing and shipping and delivery.

​

Order data marked as required is necessary to conclude and perform the contract. Without it, the order cannot be processed, or cannot be processed fully.

 

10. Customer Account

​

If you create a customer account, the information you provide is stored to enable you to use the account and place future orders. This may include:

​

• Name
• Address
• Email address
• Order history

​

Processing is based on Article 6(1)(b) GDPR.

​

You can request deletion of your customer account at any time. Statutory retention obligations for data from completed orders remain unaffected.

 

11. Performance of the Contract

​

I process the personal data necessary to perform and fulfil the contract. This includes handling your order, payment, invoicing, shipping, complaints and queries.

​

Where necessary, personal data may be passed to payment providers, shipping providers or other service providers involved in performing the contract.

​

The legal basis for processing is Article 6(1)(b) GDPR. Where statutory retention or documentation obligations apply, processing is also based on Article 6(1)(c) GDPR.

 

12. Storage of Order Data

​

I store personal data from orders for as long as necessary to perform the contract or meet statutory retention obligations.

​

Once statutory retention periods expire, data is deleted unless it remains necessary to perform the contract or establish, exercise or defend legal claims.

​

Where storage is necessary to fulfil statutory retention obligations, it is based on Article 6(1)(c) GDPR.

 

13. Payment Processing

​

Various payment methods are available for orders. Depending on the method you select, personal data necessary for payment processing is passed to the relevant payment provider.

​

This may include:

​

• First and last name
• Billing address
• Email address
• Order and invoice details
• Payment amount
• Payment information
• Transaction data
• Other information required for the relevant payment process

​

Processing is carried out to perform the purchase contract with you on the basis of Article 6(1)(b) GDPR.

​

Where payment providers process data for their own purposes, particularly fraud prevention, identity verification or credit checks, the relevant provider acts as an independent data controller.

 

13.1 PayPal

​

If you select PayPal, payment is processed through PayPal. The provider for customers in the European Economic Area is:

​

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

​

Personal data necessary to process payment is passed to PayPal. PayPal may also process personal data as an independent controller, particularly for fraud prevention, risk assessment and compliance with legal obligations.

​

Data required for payment processing is transferred on the basis of Article 6(1)(b) GDPR.

​

Further information about the processing of personal data is available in PayPal’s privacy notices.

 

13.2 Klarna

​

If you select a payment method offered through Klarna, the personal data necessary for payment processing is passed to Klarna.

​

The provider is:

​

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

​

Depending on the selected payment method, Klarna may process personal data for payment processing, identity verification, fraud prevention and, where applicable, credit checks.

​

Data required for payment processing is transferred on the basis of Article 6(1)(b) GDPR.

​

Further information about the processing of personal data is available in Klarna’s privacy notices.

​

13.3 Google Pay

​

When you use Google Pay, the Google Pay service is involved in processing your payment.

​

The provider for users in the European Economic Area is:

​

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

​

When Google Pay is used, device, account, payment and transaction information may be processed. The payment itself may also be processed by the relevant payment provider or underlying payment method.

​

Data required for payment processing is transferred on the basis of Article 6(1)(b) GDPR.

​

Further information about the processing of personal data is available in Google’s privacy notices.

 

13.4 Apple Pay

​

When you use Apple Pay, the Apple Pay service is involved in processing your payment.

​

The provider is:

​

Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

​

When Apple Pay is used, device, payment and transaction information may be processed. The payment itself is processed using the payment card stored in Apple Pay and the payment providers involved.

​

Data required for payment processing is transferred on the basis of Article 6(1)(b) GDPR.

​

Further information about the processing of personal data is available in Apple’s privacy notices.

 

13.5 Bank Transfer / Payment in Advance

​

If you pay by bank transfer, I process the data required to identify and record your payment.

​

This may include:

​

• Account holder’s name
• IBAN or account information supplied by the bank involved
• Payment amount
• Payment reference
• Payment date

​

Processing is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.

​

Payment information may also be stored to meet statutory retention obligations. The legal basis is Article 6(1)(c) GDPR.

 

14. Shipping and Delivery

​

To fulfil the purchase contract, I pass the personal data necessary to deliver your order to the shipping provider I commission.

​

This includes your name and delivery address and any other shipping information required for delivery.

​

The transfer is carried out to perform the contract on the basis of Article 6(1)(b) GDPR.

​

14.1 DHL

​

I may use DHL to ship orders.

​

The provider is:

​

DHL Paket GmbH
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany

​

Personal data required for delivery, particularly your name and delivery address, is passed to DHL.

​

The transfer is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.

​

If your email address or telephone number is also passed to DHL, for example for delivery notifications or arrangements, this occurs only where an appropriate legal basis under data protection law exists.

 

14.2 Hermes

​

I may also use Hermes to ship orders.

​

Personal data necessary for delivery, particularly your name and delivery address, is passed to the Hermes shipping provider commissioned for the shipment.

​

The transfer is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.

​

If additional contact information is used for shipping notifications or delivery arrangements, this occurs only where an appropriate legal basis under data protection law exists.

​

14.2 International Deliveries and Customs Clearance

​

I deliver to Germany, Austria, Switzerland, Norway and Luxembourg. Delivery to other countries worldwide is available following an enquiry and individual agreement.

​

For international deliveries, data necessary for transport and delivery may be passed to shipping companies and delivery partners in the destination country. This includes your name, delivery address and necessary shipment information.

​

Where customs clearance is required, details of the shipment’s contents and value, and necessary order and invoice data, may also be passed to customs clearance providers and the relevant customs authorities.

​

Processing is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR. Where I am legally obliged to process or transfer data, Article 6(1)(c) GDPR is the legal basis.

​

Deliveries to Austria and Luxembourg take place within the European Union. Norway is part of the European Economic Area (EEA).

​

Where personal data is transferred to recipients in Switzerland as part of a delivery, the transfer is based on the European Commission’s adequacy decision under Article 45 GDPR.

​

For individually agreed deliveries to other countries outside the EEA, the basis for transferring data depends on the recipient and destination country. Before such a transfer, I will provide additional information about the recipient country, the specific transfer basis and, where applicable, the safeguards used and how to obtain a copy.

​

For occasional deliveries to a country without an applicable adequacy decision or appropriate safeguards, a transfer may be based on Article 49(1)(b) GDPR if it is genuinely necessary to perform your contract and the legal conditions for this exception are met. Only the data necessary for this purpose is transferred.

 

15. Links to Social Networks

​

This website contains links to my social media pages, particularly Instagram, Facebook and TikTok.

​

These elements are simply links. Merely visiting my website does not generally establish a connection to these social networks.

​

Only when you click a link are you redirected to the relevant provider’s website. From that point, the provider may process personal data in accordance with its own privacy policy.

​

I have no control over the processing of data by these social networks.

 

15.1 Instagram and Facebook

​

This website contains links to my Instagram and Facebook profiles.

​

The provider of these services for users in the European Economic Area is:

​

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland

​

Clicking one of these links redirects you to Instagram or Facebook. Meta may process personal data in this process. If you are logged into an account there, Meta may be able to associate your visit with that account.

​

The nature, scope and purpose of any further processing are governed by Meta’s privacy policies.

​

Further information is available in Instagram’s and Facebook’s privacy notices.

 

15.2 TikTok

​

This website contains a link to my TikTok profile.

​

The provider of this service for users in the European Economic Area is:

​

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

​

Clicking the link redirects you to TikTok. TikTok may process personal data in this process. If you are logged into an account there, TikTok may be able to associate your visit with that account.

​

The nature, scope and purpose of any further processing are governed by TikTok’s privacy policies.

 

Further information is available in TikTok’s privacy notices.

 

16. External Links

​

This website may contain links to websites and services operated by external providers.

​

Clicking such a link takes you away from my website. From that point, the external provider may process personal data in accordance with its own privacy policy.

​

I have no control over the processing of data by these external providers. Please read the relevant provider’s privacy notices.

 

17. Retention Period

​

I store personal data only for as long as necessary for the relevant processing purpose or to meet statutory retention obligations.

​

Where statutory retention obligations apply, the relevant data is stored for the prescribed period.

​

Data necessary to establish, exercise or defend legal claims may also be stored until the applicable limitation periods expire.

​

Once the processing purpose no longer applies or the relevant retention or limitation periods expire, data is deleted or anonymised unless there are legal grounds for continued storage.

 

18. Your Rights as a Data Subject

​

Under the GDPR, you have the following rights in particular:

​

• Right of access under Article 15 GDPR
• Right to rectification under Article 16 GDPR
• Right to erasure under Article 17 GDPR
• Right to restriction of processing under Article 18 GDPR
• Right to data portability under Article 20 GDPR
• Right to object under Article 21 GDPR
• Right to withdraw consent with effect for the future under Article 7(3) GDPR

​

You can contact me at any time to exercise your rights:

​

Handmade by Matima
Proprietor: Saskia Taheri
Email: saskia.taheri@web.de

​

19. Right to Object

​

Where I process personal data on the basis of a legitimate interest under Article 6(1)(f) GDPR, Article 21 GDPR gives you the right to object at any time on grounds relating to your particular situation.

​

If you object, I will stop processing the personal data concerned unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

 

20. Withdrawal of Consent

​

You may withdraw consent you have given at any time with effect for the future.

​

This does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

​

21. Right to Complain to a Supervisory Authority

​

If you believe that the processing of your personal data breaches the GDPR, you have the right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR.

​

In particular, you may contact the supervisory authority responsible for me:

​

Brandenburg Commissioner for Data Protection and Access to Information (LDA Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow

 

22. Data Security

 

I take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

​

The security measures used are adjusted appropriately to reflect technical developments and the relevant risks.

 

23. Changes to this Privacy Policy

 

I reserve the right to update this Privacy Policy where required by changes in law, technical developments or changes to the services used on this website.

 

The current version published on this website applies.

​

Last updated: September 2026