Privacy policy
Privacy Policy
1. Introduction
This Privacy Policy describes how Memas Trading GmbH i. G., trading as Memas Dessert, collects, uses, stores and otherwise processes personal data when you visit our online shop, place an order, contact us, create a customer account, subscribe to marketing communications or otherwise use our services.
We process personal data in accordance with applicable data-protection law, including the General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”), where applicable.
2. Controller
The controller responsible for the processing of personal data is:
Memas Trading GmbH i. G.
Memas Dessert
Goebenstr. 10
10783 Berlin
Germany
Email: support@memasdessert.com
For questions concerning this Privacy Policy or the processing of your personal data, please contact us using the email address above.
3. Personal Data We Process
Depending on how you interact with our online shop and services, we may process the following categories of personal data:
- name;
- billing address;
- shipping and delivery address;
- email address;
- telephone number;
- customer account information;
- order and transaction information;
- products purchased or viewed;
- payment-related information;
- delivery and tracking information;
- customer service communications;
- refund, cancellation and complaint information;
- device and browser information;
- IP address;
- cookie and similar technology information;
- website usage and interaction data;
- marketing preferences; and
- fraud-prevention and security information.
We only process personal data where there is a legal basis for doing so.
4. Purposes and Legal Bases for Processing
We process personal data for the purposes described below.
Order Processing and Contract Performance
We process personal data to:
- receive and process orders;
- verify order information;
- process payments;
- prepare and fulfil orders;
- arrange shipping and delivery;
- provide tracking information;
- process cancellations and refunds;
- manage customer complaints; and
- communicate with customers regarding their orders.
The legal basis for this processing is Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps at the customer’s request before entering into a contract.
Legal and Regulatory Obligations
We may process and retain personal data where necessary to comply with legal obligations, including accounting, tax, commercial record-keeping, food-safety or other applicable legal requirements.
The legal basis is Article 6(1)(c) GDPR.
Customer Service
When you contact us, we process the information contained in your communication and any information reasonably necessary to respond to your request.
Depending on the nature of the communication, the legal basis may be Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.
Our legitimate interest is to provide customer service, resolve customer requests and document relevant communications.
Fraud Prevention and Security
We may process personal data to detect, investigate and prevent fraudulent transactions, payment misuse, account misuse and other unlawful or harmful activities.
The legal basis is Article 6(1)(f) GDPR.
Our legitimate interests include protecting our business, customers, payment systems and online shop against fraud, misuse and security risks.
Marketing
Where legally permitted, we may process contact information and marketing preferences to send newsletters, product information, promotions or other marketing communications.
Where consent is required, the legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future.
Where direct marketing is based on a legitimate interest and legally permitted, the legal basis may be Article 6(1)(f) GDPR.
You may object to direct marketing at any time.
5. Shopify
Our online shop is operated using the Shopify commerce platform.
Shopify provides the technical infrastructure used to operate the online shop, process orders, manage customer information and provide related commerce services.
Personal data may therefore be processed by Shopify in connection with your use of our online shop and our use of Shopify services.
Shopify may process information such as:
- contact information;
- order information;
- transaction information;
- device and browser information;
- IP address; and
- website interaction information.
Further information regarding Shopify’s processing of personal data is available in Shopify’s own privacy information.
Where required, personal data may be transferred internationally in accordance with applicable data-protection requirements and appropriate transfer mechanisms.
6. Payment Processing
We offer the payment methods displayed during checkout.
Depending on the payment method selected, personal data necessary to process the payment may be transmitted to the relevant payment service provider.
Payment service providers may process information including:
- name;
- billing information;
- transaction amount;
- payment method;
- order information;
- device or technical information; and
- fraud-prevention information.
Payment providers may act as independent controllers for certain processing activities and may apply their own privacy policies.
Shopify Payments
Where Shopify Payments is used, payment-related information is processed through Shopify and its relevant payment infrastructure.
Klarna
Where Klarna is selected as a payment method, information necessary to provide and process the selected Klarna payment service may be transmitted to Klarna.
Klarna may carry out identity, credit, payment-risk or fraud-prevention checks in accordance with applicable law and Klarna’s own privacy information.
PayPal
Where PayPal is selected as a payment method, information necessary to process the payment is transmitted to PayPal.
PayPal processes personal data in accordance with its own privacy information and applicable data-protection law.
Credit and Debit Cards
Where payment is made by credit or debit card, payment information is processed by the relevant payment infrastructure and payment service providers.
We do not necessarily receive or store complete card details.
7. Shipping and Delivery Providers
To fulfil and deliver orders, we may provide necessary personal data to shipping, logistics and delivery service providers.
Depending on the carrier used for an individual shipment, this may include providers such as DHL, UPS, DPD, Hermes or other shipping and logistics partners.
Information shared may include:
- recipient name;
- delivery address;
- email address;
- telephone number, where necessary;
- order or shipment reference information; and
- delivery instructions.
The legal basis is Article 6(1)(b) GDPR where the processing is necessary to fulfil and deliver the order.
Where contact information is transmitted for delivery notifications or delivery coordination, the applicable legal basis depends on the individual service and legal requirements.
Shipping carriers may process personal data as independent controllers for certain aspects of their transportation and delivery services.
8. Customer Communications and Support
When you contact us by email, contact form or another customer service channel, we process the personal data contained in your communication.
This may include:
- your name;
- email address;
- order number;
- message content;
- photographs;
- product information;
- shipping information; and
- complaint or refund information.
Where you provide photographs relating to damaged products or packaging, we process those photographs for the purpose of reviewing and resolving the claim.
Please avoid sending unnecessary personal or sensitive information in photographs or attachments.
We may use customer-service technology and service providers to manage and respond to customer communications.
9. Cookies and Similar Technologies
Our online shop may use cookies and similar technologies.
These technologies may be used to:
- operate essential website functions;
- maintain shopping-cart functionality;
- provide checkout functions;
- remember preferences;
- protect the website against fraud and misuse;
- analyse website performance and usage; and
- provide advertising or marketing functions where legally permitted.
Strictly necessary technologies may be used where required to provide the website or services requested by the user.
For non-essential cookies and similar technologies, consent will be requested where required by applicable law.
You can manage available cookie preferences through the consent or privacy settings provided on our website.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
10. Analytics and Website Measurement
Where permitted and, where required, after obtaining consent, we may use analytics and measurement technologies to understand how visitors use our online shop.
Such processing may include information regarding:
- pages visited;
- products viewed;
- website interactions;
- approximate location derived from technical information;
- device and browser type;
- referral information; and
- purchase or conversion events.
We use this information to analyse website performance, improve our online shop and understand the effectiveness of our services and marketing.
The legal basis is Article 6(1)(a) GDPR where consent is required.
11. Advertising and Social Media Technologies
Where legally permitted and, where required, after obtaining consent, we may use advertising and social media technologies provided by platforms such as Meta and TikTok.
These technologies may help us:
- measure advertising performance;
- understand conversions;
- create advertising audiences;
- limit or optimise advertising; and
- show more relevant advertising.
Depending on your consent choices and the technology used, information concerning website interactions, device information and purchase or conversion events may be processed.
The legal basis is Article 6(1)(a) GDPR where consent is required.
You may withdraw your consent at any time through the available cookie or privacy settings.
The relevant platform providers may process personal data in accordance with their own privacy policies and may act as independent controllers for certain processing activities.
12. Disclosure of Personal Data
We may disclose personal data to service providers and other recipients where necessary for the purposes described in this Privacy Policy.
Recipients may include:
- ecommerce platform providers;
- payment service providers;
- banks and financial service providers;
- shipping and logistics providers;
- customer-service providers;
- email and communication service providers;
- website hosting and technical service providers;
- fraud-prevention and security providers;
- analytics providers;
- advertising and social media platforms, where legally permitted;
- professional advisers, including accountants, tax advisers and lawyers; and
- public authorities or courts where legally required.
We do not disclose personal data to third parties without a legal basis.
13. International Data Transfers
Some service providers may process personal data outside Germany or the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area, we take into account the applicable GDPR requirements for international data transfers.
Depending on the recipient and destination country, transfers may be based on:
- an adequacy decision of the European Commission;
- the EU-U.S. Data Privacy Framework, where applicable;
- Standard Contractual Clauses approved by the European Commission; or
- another legally recognised transfer mechanism.
Additional safeguards may be used where required.
14. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was processed or as required by applicable law.
Order, invoice, payment and transaction information may be retained in accordance with applicable German commercial and tax retention obligations.
Customer communications may be retained for as long as necessary to process the relevant request, document the matter, establish or defend legal claims, or comply with legal obligations.
Where processing is based on consent, relevant data may be processed until consent is withdrawn, unless another legal basis or retention obligation applies.
After the applicable retention period expires, personal data is deleted or anonymised unless further processing is legally required or permitted.
15. Data Security
We take reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, no method of transmission over the internet or electronic storage system can guarantee absolute security.
Customers are responsible for protecting their account credentials and should not share passwords or login information with unauthorised persons.
16. Your Data Protection Rights
Subject to the requirements of applicable law, you may have the following rights:
Right of Access
You may request information regarding whether we process your personal data and request access to that data.
Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure
You may request deletion of personal data where the applicable legal requirements are met.
Right to Restriction of Processing
You may request restriction of processing where the applicable legal requirements are met.
Right to Data Portability
Where the applicable requirements are met, you may receive personal data you have provided to us in a structured, commonly used and machine-readable format or request its transmission to another controller.
Right to Object
Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time with effect for the future.
The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
17. Exercising Your Rights
To exercise your data-protection rights, please contact:
Memas Trading GmbH i. G.
Goebenstr. 10
10783 Berlin
Germany
Email: support@memasdessert.com
We may request reasonable information necessary to verify your identity before processing a data-protection request.
18. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
The supervisory authority responsible for our establishment is generally:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
You may also have the right to contact another competent supervisory authority in accordance with applicable law.
19. Children
Our online shop is not specifically directed at children.
Persons who do not have the legal capacity required to enter into a purchase contract should use the online shop only with the involvement of a parent, legal guardian or other legally authorised person where required.
We do not knowingly use children’s personal data for targeted advertising in violation of applicable law.
20. Changes to This Privacy Policy
We may update this Privacy Policy where necessary to reflect changes to our services, technology, legal requirements or data-processing activities.
The current version of the Privacy Policy will be published on our online shop.
Material changes will be communicated where required by applicable law.
21. Contact
For privacy-related questions or requests, please contact:
Memas Trading GmbH i. G.
Memas Dessert
Goebenstr. 10
10783 Berlin
Germany
Email: support@memasdessert.com