Privacy Policy

Last updated: October 2026. This English version is provided for convenience; the German version is authoritative.

1. Controller

Kathy Jewels
Owner: Katrin Herr
Bolkerstraße 57
40213 Düsseldorf
Germany

Phone: +49 177 713 8813
Email: info@kathy-jewels.com

2. General information on data processing

We take the protection of your personal data very seriously. Personal data is treated confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This privacy policy explains which personal data we collect, for what purposes we use it and to whom we disclose it.

Providing your data is necessary to conclude and perform a purchase contract. Without this data we cannot process your order. We do not use automated decision-making, including profiling.

3. Hosting by Shopify

Our online shop runs on the Shopify platform. The provider is:

  • Shopify International Ltd., 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (for customers in the EEA)

Data may also be processed by:

  • Shopify, Inc., 151 O’Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada
  • Shopify Data Processing (USA) Inc. (USA)

Shopify stores personal data on servers that may be located in Canada, the USA and other countries. An adequate level of data protection is ensured by the EU Commission's Standard Contractual Clauses (SCC) and, for Canada, by an adequacy decision of the EU Commission.

More information: https://www.shopify.com/legal/privacy

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to provide our shop reliably and securely.

4. Collection and storage of personal data

a) When visiting the website

When you visit our website, Shopify automatically collects the following data (server log files):

  • IP address
  • Browser type and version
  • Date and time
  • Pages visited
  • Referring source
  • Device information

Legal basis: Art. 6(1)(f) GDPR

b) Customer account

If you create a customer account, we collect:

  • Name
  • Email address
  • Delivery address
  • Order history

Legal basis: Art. 6(1)(b) GDPR (performance of contract)

c) Orders

When you place an order, we process:

  • First and last name
  • Delivery and billing address
  • Email address
  • Products ordered
  • Payment information (processed directly by the payment provider, depending on the method)

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention obligations)

d) Contact form and contact by email or phone

If you contact us via the contact form, by email or by phone, we process:

  • Name
  • Email address or phone number
  • Content of your message

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry)

e) Newsletter

If you subscribe to our newsletter, we store:

  • Your email address
  • Time of subscription
  • IP address

Legal basis: Art. 6(1)(a) GDPR (consent)

You can unsubscribe at any time via the link in the newsletter or by emailing us.

f) Online withdrawal form

We offer an online form for declaring a withdrawal or return. It is provided by 401layers UG (haftungsbeschränkt), Germany (app “EU Widerruf Button”). The data you enter (name, email address, order number, item details and, if applicable, your message) is processed, transmitted to us and confirmed to you by email.

Legal basis: Art. 6(1)(b) and (c) GDPR

5. Payment providers

We use the payment options provided via Shopify. Depending on your choice, the following providers may process your payment data directly:

  • Shopify Payments (credit card, Apple Pay, Google Pay, etc.)
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
  • Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden

These providers only receive the data required to process the payment. For payment methods such as invoice or instalments, the provider may carry out an identity and credit check. Please refer to the respective provider's privacy notice for details.

The PayPal button is also loaded on our product pages. This establishes a connection to PayPal servers and transmits, among other things, your IP address.

Legal basis: Art. 6(1)(b) GDPR; for loading the PayPal button Art. 6(1)(f) GDPR

6. Shipping provider (DHL)

To ship your order, we pass personal data to:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn, Germany

Data passed on:

  • Name
  • Delivery address
  • If applicable, email address for shipment notifications (only with your consent, Art. 6(1)(a) GDPR)

Legal basis: Art. 6(1)(b) GDPR

7. Customer reviews (Judge.me)

We use the Judge.me service for product reviews. After an order, we may ask you by email to leave a review. If you submit a review, your name (or a name you choose), your review, any photos and your email address are processed. The review is published on our website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in customer feedback) and Art. 6(1)(a) GDPR for publishing your review. You can object to receiving review requests at any time.

More information: https://judge.me/privacy

8. Live chat (Chatway)

We offer a live chat on our website provided by Chatway (Premio). When you use the chat, your messages, possibly your name and email address and technical data (e.g. IP address, browser information) are processed. Data may be transferred to the USA.

Legal basis: Art. 6(1)(b) GDPR for order-related enquiries, otherwise Art. 6(1)(f) GDPR, or, where information is stored on your device, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

9. Pop-ups and promotions

We use the services Getsitecontrol and Autoketing to display pop-ups (e.g. newsletter or discount notices). Technical data (e.g. IP address, browser information, interactions with the pop-up) and, if you enter it, your email address are processed.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent); when entering your email address Art. 6(1)(a) GDPR.

10. Google Fonts and YouTube

Fonts (Google Fonts) and, where applicable, YouTube videos are loaded on our website from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address is transmitted to Google; a transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR (consistent and appealing presentation); for YouTube videos Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

More information: https://policies.google.com/privacy

11. Cookies

Our website uses cookies and similar technologies. We set technically necessary cookies (e.g. for the shopping cart or checkout) on the basis of § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

All other cookies (e.g. for statistics, marketing or convenience features) are only set with your consent on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw or change your consent at any time via the cookie settings.

12. Storage period

We store your data:

  • for as long as necessary to perform the contract
  • or as required by statutory retention obligations (generally 6 or 8–10 years under commercial and tax law)

We delete data from enquiries once the enquiry has been finally dealt with and no retention obligations apply. Newsletter data is stored until you unsubscribe.

13. Your rights

You have the right at any time to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdraw consent with effect for the future (Art. 7(3) GDPR)
  • Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object to this processing at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, an informal message to info@kathy-jewels.com is sufficient.

Competent supervisory authority:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany

14. Changes to this privacy policy

This privacy policy is current as of October 2026. It may need to be amended as our shop develops or due to changes in legal requirements.