Privacy policy

Privacy Policy

Last updated: 5 October 2026

I am happy you are visiting Maviene. Here I explain which personal data I process when you visit my shop, place an order or subscribe to my newsletter, and what rights you have.

1. Controller

Maviene
Madeline Vivienne Kulesch
Am Holunderbusch 26
40470 Düsseldorf, Germany
Phone: +49 159 04830802
Email: info@maviene.com

I am not required to appoint a data protection officer. If you have questions about data protection, just write to me at info@maviene.com.

2. Hosting and shop system (Shopify)

My shop runs on the Shopify platform. The provider for Europe is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores the shop content, order and customer data and provides the checkout. Data may also be transferred to Shopify Inc. in Canada and to service providers in the USA. An adequacy decision of the EU Commission exists for Canada. For transfers to the USA, Shopify relies on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. A data processing agreement is in place with Shopify.

When you visit the website, technically necessary data is processed, for example IP address, date and time, page visited, browser and operating system. This is necessary to deliver the site and to operate it in a stable and secure way (Art. 6(1)(f) GDPR).

3. Orders and customer account

When you place an order, I process the data required to handle it: name, delivery address, billing address, email address, phone number if applicable, ordered products and payment information. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

If you create a customer account, I store your data there so you can view orders and addresses. You can have your account deleted at any time.

Due to commercial and tax law obligations, I keep order and invoice data for up to ten years, accounting records for eight years (Art. 6(1)(c) GDPR). After that they are deleted.

4. Payment

Depending on the payment method chosen, I pass the necessary payment data on to the respective payment provider (Art. 6(1)(b) GDPR):

Shopify Payments (credit card, Apple Pay, Google Pay and others): Shopify International Limited, Ireland, using Stripe Payments Europe Limited, Ireland.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out an identity and credit check to assess the payment method. Details can be found in Klarna's privacy notice.
Shop Pay: If you use Shop Pay, your data is additionally stored by Shopify for the Shop Pay function.

The payment providers are partly responsible for their own processing. Their privacy notices also apply.

5. Shipping

For delivery I pass your name and delivery address on to the shipping provider, currently DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, or Deutsche Post AG for international shipments (Art. 6(1)(b) GDPR). For shipments to countries outside the EU (Switzerland, USA, Canada), data is also transferred to customs and postal authorities or partners in the destination country for delivery and customs clearance (Art. 49(1)(b) GDPR). I only pass your email address on to DHL if you agree in the checkout or if it is necessary for delivery, so that DHL can inform you about the shipment.

6. Contact

If you write to me by email, via the contact form or social media, I process your details to answer your request (Art. 6(1)(b) or (f) GDPR). I delete the data once the request has been dealt with and no retention obligations apply.

7. Withdrawal via the withdrawal function

If you declare a withdrawal via "Withdraw contract", I process your name, email address, order number and your details in order to handle the withdrawal and send you an acknowledgement of receipt (Art. 6(1)(c) GDPR). The function is provided by Shopify.

8. Newsletter and emails (Klaviyo)

I use Klaviyo for my newsletter. The provider is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA. Klaviyo is certified under the EU-US Data Privacy Framework; a data processing agreement with Standard Contractual Clauses is also in place.

When you sign up in the pop-up or in the footer, you first receive a confirmation email (double opt-in). Only then are you subscribed. I store your email address, the time of sign-up and confirmation, your IP address and the source of the sign-up in order to be able to prove consent. The legal basis is your consent (Art. 6(1)(a) GDPR).

With your sign-up you receive, in addition to the newsletter, personal emails relating to your activity in the shop, for example a reminder about an unfinished cart or about products you viewed. For this, Klaviyo records which products you view, add to the cart and buy. This recording in the shop only takes place if you consent to the "Marketing" category in the cookie banner or have subscribed to the newsletter. I also evaluate whether emails are opened and links clicked in order to improve the newsletter.

You can unsubscribe at any time via the unsubscribe link in every email or by writing to info@maviene.com. After unsubscribing I delete your data or block it for further emails, unless I need to keep it as proof of earlier consent.

After a purchase I also send you emails about your order (order confirmation, shipping confirmation) and, where applicable, an email with care tips or a request for a review. Advertising for my own similar products by email to existing customers only takes place in accordance with Section 7(3) of the German Unfair Competition Act (UWG), and you can object to this at any time without incurring any costs other than transmission costs at basic rates.

9. Cookies and consent

I use cookies and similar technologies (e.g. local storage, pixels). I set technically necessary cookies, for example for cart, checkout, language setting, wishlist and saving your cookie choice, on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

I only use all other cookies and services (statistics and marketing) with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent is requested by my cookie banner, which is connected to Shopify's privacy interface (Customer Privacy API). You can change or withdraw your choice at any time via the "Cookie settings" link in the footer.

10. Statistics and advertising (only with consent)

Shopify Analytics: Shopify creates statistics about visits, page views and sales for me so that I can improve the shop.

Google Analytics 4, Google Ads and Google Tag Manager: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With Google Analytics I evaluate how the shop is used. With Google Ads I run ads in Google Search and the Google network and measure whether a purchase follows an ad click (conversion tracking), including remarketing to visitors of my shop. I use Google Consent Mode: without your consent, no Google cookies are set. Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework.

Meta Pixel: The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the Meta Pixel I measure how ads on Facebook and Instagram perform and can show ads there again to people who have visited my shop. Where applicable, I also transmit events such as purchases directly from the server to Meta (Conversions API), likewise only with your consent. Meta and I are joint controllers for the collection and transmission (Art. 26 GDPR). The agreement can be found at facebook.com/legal/controller_addendum. Data may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework.

11. Other services in the shop

Weglot: The translation service Weglot of Weglot SAS, Paris, France, may be integrated. Technical data such as the IP address is transmitted to Weglot (Art. 6(1)(f) GDPR, interest in a multilingual shop).

Instagram feed (Instafeed): On the website I show posts from my Instagram profile. The images are loaded via the Instafeed app and the content delivery network cdn.nfcube.com, which transmits your IP address (Art. 6(1)(f) GDPR).

Product reviews (Judge.me): The Shopify app Judge.me is integrated for product reviews. If you submit a review, your name, email address, review text and photos if applicable are stored, and your first name or initials are published with the review (Art. 6(1)(a) GDPR).

Trustpilot: I link to my profile on Trustpilot (Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark). Data is only transmitted when you click the link. If I invite you to review on Trustpilot after a purchase, I transmit your name, email address and order number to Trustpilot for this purpose (Art. 6(1)(f) GDPR). You can object to this at any time.

YouTube videos: Some pages contain videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Videos and related YouTube cookies are only loaded if you have consented to the "Marketing" category (Art. 6(1)(a) GDPR). Data may also be transferred to Google LLC in the USA.

Fonts: Fonts are delivered via Shopify's servers.

Social media links: Links to Instagram and TikTok are simple links. Data is only transferred when you click on them.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

Just write to me at info@maviene.com.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

13. Obligation to provide data and automated decisions

For an order I need the data marked as mandatory in the checkout, otherwise I cannot process the contract. Automated decision-making including profiling under Art. 22 GDPR does not take place. Independently of this, Klarna may carry out an automated credit check if you choose a Klarna payment method.

14. Changes

I adapt this privacy policy when the shop or the legal situation changes. The version published here applies.