Privacy policy
Last updated: August 18, 2026
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
CELONIQUE GmbH
Westhafenplatz 1 | Westhafen Tower
60327 Frankfurt am Main
Germany
Email: info@celonique.com
Website: www.celonique.com
2. General Information on Data Processing
We take the protection of your personal data seriously.
We process personal data in accordance with applicable data-protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), and, where applicable, the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).
Personal data means any information relating to an identified or identifiable natural person.
This Privacy Policy explains what personal data we process, for which purposes we process it, the legal bases for such processing, the recipients of personal data, and the rights available to you.
3. Categories of Personal Data
Depending on how you interact with our website, online shop, products and services, we may process the following categories of personal data:
-
First and last name
-
Billing and delivery address
-
Email address
-
Telephone number, where provided
-
Customer and account information
-
Order and purchase information
-
Payment and transaction information
-
Products viewed, purchased or added to the shopping cart
-
IP address
-
Browser and device information
-
Operating system and technical information
-
Website usage and interaction data
-
Cookie identifiers and similar online identifiers
-
Communication and customer-service information
-
Newsletter and marketing preferences
-
Consent and privacy-preference information
-
Information necessary for fraud prevention and website security
We process personal data only where necessary for the relevant purpose or where you voluntarily provide such information to us.
4. Purposes of Processing
We may process personal data for the following purposes:
-
Operating and providing our website and online shop
-
Managing customer accounts
-
Processing and fulfilling orders
-
Processing payments
-
Delivering products
-
Communicating with customers
-
Providing customer service
-
Processing returns, withdrawals, complaints and warranty matters
-
Preventing fraud and misuse
-
Maintaining website, system and IT security
-
Fulfilling tax, accounting and commercial-law obligations
-
Improving our website and services
-
Measuring website performance where legally permitted
-
Conducting analytics where the required legal basis exists
-
Sending newsletters and promotional communications where permitted
-
Conducting marketing and advertising where the required legal basis exists
-
Managing and documenting consent and privacy preferences
-
Establishing, exercising or defending legal claims
5. Legal Bases for Processing
Depending on the relevant processing activity, we process personal data on one or more of the following legal bases:
Art. 6(1)(a) GDPR – Consent
We process personal data on the basis of your consent where you have voluntarily agreed to a particular processing activity.
This may apply, for example, to certain newsletter, analytics, personalisation and marketing activities.
You may withdraw your consent at any time with effect for the future.
Art. 6(1)(b) GDPR – Contract and Pre-Contractual Measures
We process personal data where necessary to perform a contract with you or to take steps at your request before entering into a contract.
This applies in particular to orders, payments, deliveries and customer enquiries relating to a potential or existing purchase.
Art. 6(1)(c) GDPR – Legal Obligation
We process personal data where processing is necessary to comply with a legal obligation to which we are subject, including applicable tax, accounting and commercial-law requirements.
Art. 6(1)(f) GDPR – Legitimate Interests
We may process personal data where processing is necessary for our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override those interests.
Such legitimate interests may include:
-
Maintaining the security and stability of our website and systems
-
Preventing fraud and misuse
-
Protecting and enforcing our legal rights
-
Improving business processes
-
Responding to general enquiries
-
Handling and documenting business communications
Where consent is legally required, processing will take place only after the required consent has been obtained.
6. Shopify and Hosting of Our Online Shop
Our online shop is operated using the Shopify e-commerce platform.
For users in the European Economic Area, relevant Shopify services may involve:
Shopify International Ltd.
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify provides technical and e-commerce infrastructure used to operate our online shop, including functions relating to hosting, checkout, customer accounts, order processing, security and other shop functionality.
In connection with your use of our online shop, Shopify may process information including:
-
IP address
-
Browser and device information
-
Contact information
-
Customer and account information
-
Billing and delivery information
-
Order and transaction information
-
Information concerning interactions with our online shop
Depending on the relevant processing activity, Shopify may process personal data on our behalf or under its own responsibility in accordance with the applicable data-protection arrangements.
Personal data may also be processed by Shopify group companies and service providers outside the European Economic Area.
Where required, international transfers are protected by appropriate safeguards under Chapter V GDPR, such as an adequacy decision, approved Binding Corporate Rules, Standard Contractual Clauses or another legally recognised transfer mechanism.
Further information about Shopify's processing of personal data is available in Shopify's applicable privacy documentation.
7. Customer Accounts
If our online shop offers customer accounts and you create or use an account, we process information necessary to provide and administer your account.
This may include:
-
Name
-
Email address
-
Address information
-
Account information
-
Order history
-
Other information associated with your customer account
Where the account is used in connection with contractual or pre-contractual services, processing is generally based on Art. 6(1)(b) GDPR.
Where optional functions serve additional purposes, another applicable legal basis may apply.
8. Orders and Contract Processing
When you place an order through our online shop, we process the personal data necessary to conclude and perform the purchase contract.
This may include:
-
Name
-
Billing address
-
Delivery address
-
Email address
-
Telephone number, where provided or required
-
Products ordered
-
Order number
-
Order value
-
Delivery information
-
Payment and transaction information
The primary legal basis for this processing is Art. 6(1)(b) GDPR.
Information may additionally be processed or retained pursuant to Art. 6(1)(c) GDPR where statutory tax, accounting, commercial or other legal obligations apply.
9. Payment Processing
When you make a payment, information necessary to process the transaction may be transmitted to the payment service provider selected during checkout.
Depending on the selected payment method, this may include:
-
Name
-
Billing information
-
Order amount
-
Currency
-
Transaction information
-
Payment-related identifiers
-
Other information required to execute or secure the payment
Payment service providers may process certain information under their own responsibility, particularly for payment execution, fraud prevention, identity verification, regulatory compliance or risk assessment.
The primary legal basis for transmitting information necessary to process your payment is Art. 6(1)(b) GDPR.
Additional processing may be based on legal obligations or legitimate interests, depending on the circumstances.
The privacy information of the payment provider selected during checkout applies to processing carried out independently by that provider.
10. Shipping and Delivery
To deliver your order, we may transmit personal data required for delivery to the relevant shipping, fulfilment or logistics provider.
This may include:
-
Name
-
Delivery address
-
Order or shipment information
-
Email address or telephone number where required for delivery notifications or agreed delivery services
Processing necessary to fulfil your order is generally based on Art. 6(1)(b) GDPR.
Where contact information is transmitted for optional delivery notifications or additional services, the applicable legal basis depends on the specific circumstances.
11. Customer Service and Communications
If you contact us by email, contact form or another communication channel, we process the information you provide to respond to and manage your enquiry.
This may include:
-
Name
-
Email address
-
Order number
-
Communication content
-
Information concerning purchased products
-
Photographs or documents voluntarily submitted in connection with a customer-service matter
Where your enquiry concerns an existing contract or steps before entering into a contract, processing is generally based on Art. 6(1)(b) GDPR.
For other enquiries, processing may be based on Art. 6(1)(f) GDPR, based on our legitimate interest in responding to and managing communications.
12. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Cookies are small pieces of information stored on or accessed from your device. Similar technologies may include pixels, tags, scripts, local storage and comparable technologies.
Some technologies are necessary for the operation of our online shop, including functions relating to:
-
Shopping carts
-
Checkout
-
Security
-
Authentication
-
Network management
-
Privacy and consent settings
-
Essential website functionality
Where the storage of or access to information on your device is strictly necessary to provide a digital service expressly requested by you, such technologies may be used without consent in accordance with the applicable provisions of the TDDDG.
Where cookies or similar technologies are not strictly necessary, they are used only after consent has been obtained where required by law.
Where personal data is subsequently processed on the basis of your consent, the legal basis is generally Art. 6(1)(a) GDPR.
You can provide, refuse or withdraw your consent through the cookie or privacy settings available on our website.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Necessary technologies cannot always be disabled because they may be required for the website or online shop to function.
13. Consent Management
Where we use a consent-management system, it records and manages your privacy choices concerning optional cookies and similar technologies.
Information processed for this purpose may include:
-
Consent status
-
Selected consent categories
-
Date and time of consent
-
Technical identifiers
-
Browser or device information
-
Changes to privacy preferences
This processing enables us to respect your privacy choices and, where necessary, demonstrate compliance with applicable legal requirements.
14. Website Analytics
Where analytics services are used, information concerning your use of our website may be processed to understand how visitors use the website, evaluate website performance and improve our online shop and services.
Depending on the service used, information may include:
-
IP address
-
Device information
-
Browser information
-
Pages viewed
-
Referring pages
-
Website interactions
-
Approximate location derived from technical information
-
Session and event information
Where analytics technologies require consent, they are activated only after you have provided the necessary consent.
The legal basis for consent-based processing is Art. 6(1)(a) GDPR and, where applicable, the relevant provisions of the TDDDG.
You may withdraw your consent at any time through our cookie or privacy settings.
15. Marketing and Advertising Technologies
Where marketing or advertising technologies are used, personal data may be processed to:
-
Measure advertising performance
-
Understand whether advertisements result in visits, enquiries or purchases
-
Create or measure audiences
-
Display more relevant advertising
-
Measure conversions
-
Analyse and optimise marketing campaigns
Where consent is legally required, these technologies are activated only after you have provided your consent.
The legal basis for consent-based processing is generally Art. 6(1)(a) GDPR.
You may withdraw your consent at any time through our cookie or privacy settings.
16. Newsletter and Promotional Communications
If you subscribe to our newsletter or otherwise consent to receiving promotional communications, we process your contact information for this purpose.
This generally includes your email address and may include your name and information relating to your subscription or marketing preferences.
Where required, we may use a confirmation procedure to verify your subscription.
The legal basis for consent-based newsletter marketing is Art. 6(1)(a) GDPR.
You may withdraw your consent at any time by using the unsubscribe link contained in our promotional emails or by contacting:
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
We may retain limited information necessary to demonstrate that consent was previously provided where required for compliance with legal obligations or the establishment, exercise or defence of legal claims.
17. Social Media and External Platforms
Our website may contain links to our profiles on social-media platforms or other external services.
When you follow an external link, you leave our website. The operator of the relevant platform may process personal data independently in accordance with its own privacy policy.
Where social-media content, plugins, videos or other external services are embedded directly into our website and result in the transmission of personal data, such services are used in accordance with applicable data-protection requirements and, where required, activated only after consent has been obtained.
18. Recipients and Disclosure of Personal Data
We disclose personal data only where necessary for the relevant purpose, legally permitted, required by law or otherwise supported by an appropriate legal basis.
Recipients may include:
-
Shopify and relevant Shopify group companies
-
Hosting and technical service providers
-
Payment service providers
-
Banks and financial institutions
-
Shipping and logistics providers
-
Fulfilment providers
-
IT and security providers
-
Customer-service providers
-
Email and newsletter providers
-
Consent-management providers
-
Analytics providers, where legally permitted
-
Marketing and advertising providers, where legally permitted
-
Accountants, tax advisers, lawyers and other professional advisers
-
Courts, regulators and public authorities where legally required
Where a service provider processes personal data on our behalf as a processor, appropriate contractual arrangements are implemented as required by Art. 28 GDPR.
19. International Data Transfers
Some service providers or their subprocessors may process personal data outside the European Union or European Economic Area.
Where personal data is transferred to a third country, we observe the requirements of Chapter V GDPR.
Depending on the recipient and destination country, international transfers may be based on:
-
An adequacy decision of the European Commission
-
Approved Binding Corporate Rules
-
Standard Contractual Clauses
-
Another legally recognised transfer mechanism
-
A statutory derogation in exceptional circumstances
Additional safeguards may be implemented where required.
20. Retention and Deletion of Personal Data
We retain personal data only for as long as necessary for the purpose for which it was collected, unless longer retention is required or permitted by law.
The applicable retention period depends in particular on:
-
The purpose of processing
-
The nature and duration of the contractual relationship
-
Applicable statutory retention obligations
-
Applicable limitation periods
-
Whether information remains necessary to establish, exercise or defend legal claims
Order, invoice, accounting, tax and commercial records may be retained for the periods required under applicable German tax and commercial law.
Customer-service communications may be retained for an appropriate period depending on the nature of the enquiry and whether the information remains relevant to contractual, warranty or legal matters.
Consent records may be retained where necessary to demonstrate compliance with applicable legal requirements.
When personal data is no longer required and no statutory or other lawful basis for retention applies, it will be deleted or anonymised.
21. Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Security measures are reviewed and adapted where appropriate, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks associated with processing.
However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.
22. Your Rights Under the GDPR
Subject to the applicable legal requirements and limitations, you have the following rights concerning your personal data:
Right of Access – Art. 15 GDPR
You have the right to request information about whether we process personal data concerning you and, where applicable, to obtain access to that personal data and the information required by law.
Right to Rectification – Art. 16 GDPR
You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to Erasure – Art. 17 GDPR
You may request the deletion of your personal data where the applicable legal requirements are met.
Right to Restriction of Processing – Art. 18 GDPR
You may request restriction of processing where the applicable legal requirements are met.
Right to Data Portability – Art. 20 GDPR
Where the statutory requirements are met, you may receive personal data you have provided to us in a structured, commonly used and machine-readable format and may have the right to transmit that data to another controller.
Right to Object – Art. 21 GDPR
You have the right, under the applicable statutory conditions, to object to processing based on Art. 6(1)(e) or Art. 6(1)(f) GDPR on grounds relating to your particular situation.
Right to Withdraw Consent – Art. 7(3) GDPR
Where processing is based on consent, you may withdraw your consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
To exercise your data-protection rights, please contact:
23. Right to Object to Direct Marketing
Where your personal data is processed for direct-marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing.
This includes profiling to the extent that it is related to direct marketing.
If you object to processing for direct-marketing purposes, your personal data will no longer be processed for such purposes.
24. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
For private-sector organisations based in Hesse, the competent supervisory authority is:
Hessischer Beauftragter für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
You may also have the right to lodge a complaint with another competent supervisory authority, in particular in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.
25. Provision of Personal Data
Certain personal data is required to enter into and perform a contract with us.
For example, we require certain contact, billing, delivery, order and payment-related information to process and deliver an order.
If you do not provide information necessary for contractual processing, we may be unable to conclude or perform the relevant contract.
Information that is not required will be treated as optional where appropriate.
26. Automated Decision-Making
We do not use exclusively automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you, unless expressly stated otherwise in connection with a particular service.
Payment, security or fraud-prevention service providers may use automated systems for risk assessment under their own responsibility.
Where applicable, further information can be found in the privacy information of the relevant provider.
27. Children
Our online shop is not specifically directed at children.
We do not knowingly seek to collect personal data from children through services specifically intended for them.
Where the consent of a child is relevant to a particular information-society service, the applicable statutory requirements will be observed.
28. External Links
Our website may contain links to third-party websites.
We are not responsible for the data-protection practices of external websites operated independently by third parties.
When you visit an external website, the privacy information of the relevant website operator applies.
29. Changes to This Privacy Policy
We may update this Privacy Policy where necessary to reflect changes to our website, services, technologies, business processes or applicable legal requirements.
The current version will be made available on our website.
Where required by law, we will provide additional information or obtain consent before implementing changes affecting consent-based processing.
30. Contact Regarding Data Protection
If you have questions concerning this Privacy Policy, the processing of your personal data, or wish to exercise your data-protection rights, please contact:
CELONIQUE GmbH
Westhafenplatz 1 | Westhafen Tower
60327 Frankfurt am Main
Germany
Email: info@celonique.com
Website: www.celonique.com