Privacy Policy

This privacy policy is required by European and German law. The original German version is legally binding. This English translation is provided for your convenience only.

1. Data Controller

The data controller within the meaning of the GDPR is:

machuPICyou GmbH
Marienplatz 1
08056 Zwickau
Germany

Represented by: Swen Lämmel
Email: support@machupicyou.com
Web: machupicyou.com

2. Overview of Data Processing and Legal Bases

We process personal data only insofar as this is necessary to provide our online shop and our services. Processing is based on the following legal bases of the GDPR:

  • Art. 6(1)(a) GDPR – Consent (e.g. newsletter, non-essential cookies)
  • Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures (e.g. order processing)
  • Art. 6(1)(c) GDPR – Legal obligation (e.g. tax and commercial record-keeping requirements)
  • Art. 6(1)(f) GDPR – Legitimate interest (e.g. fraud prevention, website security, direct marketing to existing customers)

3. Data Collection When Visiting Our Website

When you access our website, the browser on your device automatically transmits information to our website server. This information is temporarily stored in server log files:

  • IP address of the requesting device (anonymised after a short storage period)
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which access was made (referrer URL)
  • Browser used, operating system and screen resolution

This data is processed to ensure stable operation and security of our website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). The data is automatically deleted after 7 days at the latest.

4. SSL Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and the lock icon in the browser bar. When SSL encryption is active, the data you transmit to us cannot be read by third parties.

5. Hosting by Shopify

Our online shop is operated on the e-commerce platform Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes all data arising from the operation of the shop and from orders on our behalf (customer data, order data, payment data, server logs).

A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Shopify. For transfers of personal data to countries outside the European Economic Area (EEA), we rely on the standard contractual clauses concluded by Shopify pursuant to Art. 46(2)(c) GDPR.

More information can be found in the Shopify Privacy Policy.

6. Orders and Customer Accounts

When you place an order or create a customer account, we collect the following data as provided by you:

  • First and last name
  • Shipping and billing address
  • Email address
  • Phone number (optional, for delivery enquiries by the shipping provider)
  • Payment information (transmitted directly to the respective payment provider)
  • Order history and communication with our support team

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Data relevant to tax and commercial law (particularly invoice data) is stored for up to 10 years in accordance with § 147 AO and § 257 HGB and then deleted.

7. Contact Form and Email Communication

When you contact us via our contact form or by email, your name, email address and message are stored to process your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The data is deleted once the enquiry has been conclusively dealt with and no statutory retention requirements apply.

8. Newsletter (Shopify Email)

If you subscribe to our newsletter, your email address is used on the basis of your consent (Art. 6(1)(a) GDPR) for sending advertising and information emails. We use the integrated email service Shopify Email, which is operated as part of the Shopify platform (DPA pursuant to Art. 28 GDPR is in place).

Registration uses the double opt-in procedure: after registration you receive a confirmation email with an activation link. Your registration only becomes effective after clicking this link. We log the registration time and IP address.

You can unsubscribe from the newsletter at any time, e.g. via the unsubscribe link at the end of each newsletter email or by email to support@machupicyou.com. After unsubscribing, your email address will be immediately removed from the mailing list.

9. Cookies

Our website uses cookies. These are small text files stored by the browser on your device containing certain information.

Technically necessary cookies: These cookies are required for the operation of the online shop (e.g. shopping cart, session management, login). They are set without your consent. The legal basis is Art. 6(1)(f) GDPR.

Analytics and marketing cookies: These cookies are only set with your explicit consent (Art. 6(1)(a) GDPR). You will be asked for your consent via a cookie notice on your first visit. You can revoke your consent at any time by changing your browser cookie settings or calling up our cookie banner again.

Most browsers accept cookies automatically. You can set your browser not to store cookies or to inform you before storage. Disabling cookies may limit the functionality of the online shop.

10. Payment Service Providers

For processing payments in the online shop, we use the following external payment service providers. Depending on the chosen payment method, your payment data is transmitted directly to the respective provider. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

We do not store any complete payment data (e.g. card numbers) ourselves. The payment service providers process your data under their own responsibility in accordance with their privacy policies.

11. Shipping Provider (DHL)

To deliver your order, we forward your name, delivery address and – if necessary for shipment tracking – your email address to Deutsche Post DHL Group (Deutsche Post AG, Bonn). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

More information can be found in the DHL Privacy Policy.

12. Social Media

Our website contains links to our social media profiles. By clicking these links you leave our website and are redirected to the respective platform. We have no influence on data processing by the platform operators.

The platforms process your data in accordance with their own privacy policies. We recommend reading these:

We operate these profiles to present our offerings and interact with our community. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in marketing and customer communication).

14. Your Rights as a Data Subject

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR) – You may request information about your personal data processed by us.
  • Rectification (Art. 16 GDPR) – You may request immediate rectification of inaccurate or completion of incomplete data.
  • Erasure (Art. 17 GDPR) – You may request erasure of your data, provided no statutory retention obligations or other legitimate processing grounds apply.
  • Restriction of processing (Art. 18 GDPR) – Under certain conditions, you may request restriction of the processing of your data.
  • Data portability (Art. 20 GDPR) – You may request to receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR) – You have the right to object at any time to the processing of your data insofar as the processing is based on Art. 6(1)(f) GDPR (legitimate interest).
  • Withdrawal of consent (Art. 7(3) GDPR) – You may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out prior to the withdrawal.

To exercise your rights, please contact: support@machupicyou.com

We will process your request within 30 days. In complex cases, this period may be extended by a further 60 days; we will inform you accordingly.

15. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority for Saxony is:

Saxon Data Protection and Transparency Commissioner
Devrientstraße 5
01067 Dresden
www.saechsdsb.de

16. Currency of This Privacy Policy

This privacy policy is currently valid (as of April 2026). Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can always be found on this page.