Privacy policy
Last updated: October 2026. This English version is provided for convenience; the German version is authoritative.
1. Controller
Kathy Jewels
Owner: Katrin Herr
Bolkerstraße 57
40213 Düsseldorf
Germany
Phone: +49 177 713 8813
Email: info@kathy-jewels.com
2. General information on data processing
We take the protection of your personal data very seriously. Personal data is treated confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
This privacy policy explains which personal data we collect, for what purposes we use it and to whom we disclose it.
Providing your data is necessary to conclude and perform a purchase contract. Without this data we cannot process your order. We do not use automated decision-making, including profiling.
3. Hosting by Shopify
Our online shop runs on the Shopify platform. The provider is Shopify International Ltd., 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (for customers in the EEA). Data may also be processed by Shopify, Inc., 151 O’Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada, and Shopify Data Processing (USA) Inc. (USA).
Shopify stores personal data on servers that may be located in Canada, the USA and other countries. An adequate level of data protection is ensured by the EU Commission's Standard Contractual Clauses (SCC) and, for Canada, by an adequacy decision of the EU Commission. More information: https://www.shopify.com/legal/privacy
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to provide our shop reliably and securely.
4. Collection and storage of personal data
a) When visiting the website
When you visit our website, Shopify automatically collects server log files (IP address, browser type and version, date and time, pages visited, referring source, device information). Legal basis: Art. 6(1)(f) GDPR
b) Customer account
If you create a customer account, we collect your name, email address, delivery address and order history. Legal basis: Art. 6(1)(b) GDPR
c) Orders
When you place an order, we process your first and last name, delivery and billing address, email address, the products ordered and payment information (processed directly by the payment provider). Legal basis: Art. 6(1)(b) and (c) GDPR
d) Contact form and contact by email or phone
If you contact us, we process your name, email address or phone number and the content of your message. Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR.
e) Newsletter
If you subscribe to our newsletter, we store your email address, the time of subscription and your IP address. Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe at any time.
f) Online withdrawal form
Our online form for withdrawals and returns is provided by 401layers UG (haftungsbeschränkt), Germany (app “EU Widerruf Button”). The data you enter is processed, transmitted to us and confirmed to you by email. Legal basis: Art. 6(1)(b) and (c) GDPR
5. Payment providers
Depending on your choice, the following providers may process your payment data directly: Shopify Payments (credit card, Apple Pay, Google Pay, etc.); PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For invoice or instalment payments, the provider may carry out an identity and credit check. The PayPal button loaded on our product pages transmits your IP address to PayPal. Legal basis: Art. 6(1)(b) GDPR; for the PayPal button Art. 6(1)(f) GDPR
6. Shipping provider (DHL)
To ship your order, we pass your name, delivery address and, with your consent, your email address for shipment notifications to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. Legal basis: Art. 6(1)(b) GDPR
7. Customer reviews (Judge.me)
We use Judge.me for product reviews and may ask you by email to leave a review. Your name, review, any photos and email address are processed; reviews are published on our website. Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR. More information: https://judge.me/privacy
8. Live chat (Chatway)
Our live chat is provided by Chatway (Premio). Your messages, possibly your name and email address and technical data are processed; data may be transferred to the USA. Legal basis: Art. 6(1)(b) or (f) GDPR, or consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
9. Pop-ups and promotions
We use Getsitecontrol and Autoketing to display pop-ups. Technical data and, if entered, your email address are processed. Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
10. Google Fonts and YouTube
Fonts and, where applicable, YouTube videos are loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; your IP address is transmitted to Google and a transfer to the USA is possible (Google LLC is certified under the EU-US Data Privacy Framework). Legal basis: Art. 6(1)(f) GDPR; for YouTube Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
11. Cookies
Technically necessary cookies are set on the basis of § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR. All other cookies are only set with your consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.
12. Storage period
We store your data for as long as necessary to perform the contract or as required by statutory retention obligations (generally 6 or 8–10 years). Enquiry data is deleted once dealt with; newsletter data is stored until you unsubscribe.
13. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7(3)) and to lodge a complaint with a supervisory authority (Art. 77 GDPR).
Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
To exercise your rights, simply email info@kathy-jewels.com. Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
14. Changes
This privacy policy is current as of October 2026 and may be amended as our shop develops or legal requirements change.
