Privacy Policy

This English version is provided for convenience; the German version is legally binding.

Protecting your personal data is important to us. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we inform you below which personal data we process when you visit our website magicpureshine.de and use our online shop, for what purposes and on what legal basis this is done, and what rights you have.

1. Controller

The controller within the meaning of the GDPR is:

If you have any questions about data protection or wish to exercise your rights, you can contact us at any time using the contact details above or our contact form.

2. General information on data processing

Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, e-mail address or IP address. We only process personal data to the extent necessary to provide a functional website, to process your orders and enquiries or to comply with legal obligations, or where you have given your consent.

Legal bases

• Art. 6(1)(a) GDPR – consent, where we ask you for consent;
• Art. 6(1)(b) GDPR – performance of a contract with you or pre-contractual measures taken at your request;
• Art. 6(1)(c) GDPR – compliance with legal obligations, e.g. retention obligations under commercial and tax law;
• Art. 6(1)(f) GDPR – our legitimate interests or those of third parties, unless your interests or fundamental rights and freedoms override them.

Where information is stored on or read from your device (e.g. cookies), this is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as your orders and enquiries, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser.

3. Hosting and provision of the website

Google Cloud and Firebase App Hosting

Our website is operated via Firebase App Hosting on the infrastructure of the Google Cloud Platform. The providers are Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, and – for the Firebase services – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (together “Google”). The servers on which our website runs are located in the Google Cloud region europe-west3 in Frankfurt am Main, Germany. Our database (Google Cloud SQL), which stores in particular order, customer account and enquiry data, is also located there. We store media files such as product images in Firebase Storage.

Google processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The legal basis for hosting is our legitimate interest in the secure, fast and reliable provision of our website (Art. 6(1)(f) GDPR) and, where data is processed to perform a contract, Art. 6(1)(b) GDPR. For more information, see the Google Cloud Privacy Notice.

Server log files

Each time our website is accessed, information transmitted by your browser is recorded automatically (server log files). This includes in particular:

• IP address of the requesting device,
• date and time of access,
• requested page or file (URL) and HTTP status code,
• browser and operating system used (user agent).

This data is processed to ensure the security and stability of our website, in particular to detect and prevent attacks and misuse and to analyse errors. The legal basis is Art. 6(1)(f) GDPR. This data is not merged with other data sources. Log data is deleted as soon as it is no longer required for these purposes, usually after 30 days, unless a specific security incident requires longer retention for evidence purposes.

Transfers to third countries

When Google services are used, it cannot be ruled out that data is transferred to or accessed from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework; for certified companies there is an adequacy decision of the European Commission (Art. 45 GDPR). In addition, Google has concluded EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4. Cookies and similar technologies

We only use technically necessary cookies and similar technologies that are required for you to use the functions of our shop you have expressly requested (e.g. shopping cart, customer account login, language selection, secure payment). They are stored and accessed on the basis of Section 25(2) No. 2 TDDDG and therefore do not require consent. The subsequent processing is based on Art. 6(1)(b) GDPR or on our legitimate interest in a functional and secure shop (Art. 6(1)(f) GDPR). We do not use marketing or tracking cookies, which is why we do not display a cookie consent banner.

You can view and delete cookies and restrict their use at any time in your browser settings. If you block technically necessary cookies, some functions (e.g. shopping cart, customer account or payment) may not be available.

5. Audience measurement with Plausible Analytics

For the statistical analysis of the use of our website, we use Plausible Analytics, a service provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible works without cookies and without creating user profiles; there is no tracking across websites or devices. Aggregated information is collected, such as pages visited, referring website (referrer), browser, operating system, device type and the country derived from the IP address. Your IP address is not stored; together with the browser identifier, it is only used to generate an anonymous identifier with the help of a random value that changes daily, which does not allow any conclusions to be drawn about you. The data is processed exclusively on servers in the European Union.

Plausible acts as our processor (Art. 28 GDPR). The legal basis is our legitimate interest in a privacy-friendly analysis of the use of our website in order to improve our offering (Art. 6(1)(f) GDPR). More information: Plausible data policy.

6. Fonts

The fonts used on our website are hosted locally on our server. No connection to servers of Google Fonts or other third-party providers is established when you access the website.

7. Orders, payment and shipping

Order processing

When you order in our shop – as a guest or via your customer account – we process the data required for processing: name, billing and delivery address, e-mail address, phone number (if provided), items ordered, prices, chosen payment method, payment status and order number. We use this data to perform the contract, for delivery, for communication regarding your order and to handle withdrawals, returns and warranty claims. The legal basis is Art. 6(1)(b) GDPR; order and invoice data is retained to comply with legal obligations (Art. 6(1)(c) GDPR).

Payment processing via Stripe

Payment is made via the checkout embedded in our website (Stripe Embedded Checkout) of our payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). The data you enter in the checkout – in particular name, e-mail address, billing and delivery address, payment details (e.g. card number or IBAN), invoice amount and order number – is transmitted directly to Stripe. We do not receive complete card or account details. For fraud prevention, Stripe also processes technical information such as IP address, device and browser information.

Stripe processes your data partly on our behalf and partly – for example for fraud prevention and to comply with regulatory obligations – as an independent controller. A transfer to Stripe, Inc. in the USA is possible; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses are used in addition. The legal bases are Art. 6(1)(b) GDPR (payment processing), Art. 6(1)(c) GDPR (legal obligations, e.g. anti-money laundering) and Art. 6(1)(f) GDPR (fraud prevention). More information: Stripe privacy policy.

PayPal

If you pay with PayPal, the data required for payment processing (in particular name, address, e-mail address, invoice amount and order number) is transmitted via Stripe to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal acts as an independent controller. The legal basis is Art. 6(1)(b) GDPR. More information: PayPal privacy statement.

Klarna

If you choose a Klarna payment method, your contact and order details (in particular name, address, e-mail address, phone number if applicable, invoice amount and items ordered) are transmitted via Stripe to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. To check your identity and creditworthiness, Klarna may transmit data to and receive information from credit agencies; the result determines which Klarna payment methods are offered to you. Klarna acts as an independent controller for this processing. The legal bases are Art. 6(1)(b) and (f) GDPR. More information: Klarna privacy notice.

Shipping

To deliver your order, we pass on your name, delivery address and – if provided – your phone number to the transport company commissioned in each case (parcel service or freight forwarder). For freight deliveries, the phone number is needed so that the forwarder can arrange the delivery date with you. The legal basis is Art. 6(1)(b) GDPR.

8. Sending e-mails via Resend

To send transactional e-mails – e.g. order confirmations, confirmations of receipt for withdrawals and returns, messages about your customer account and notifications about form enquiries received – we use the Resend service of Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. In doing so, your e-mail address, your name, the content of the respective e-mail and technical delivery data (e.g. time and delivery status) are processed. Resend acts as our processor; the transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in the reliable delivery of our e-mails (Art. 6(1)(f) GDPR). More information: Resend privacy policy.

9. Customer account

You can create a customer account voluntarily. For this purpose, we process your e-mail address and your password; the password is only stored in encrypted (hashed) form. In your customer account you can view your orders, shipment status and return requests; for this purpose we link your order data to your account. The legal basis is Art. 6(1)(b) GDPR. You can request the deletion of your customer account at any time; data that we must continue to store due to statutory retention obligations will be blocked until these periods expire.

10. Contact form and dealer enquiries

If you contact us via the contact form, the form for dealer and business customer enquiries or by e-mail, we process the data you provide – depending on the form, name, company, e-mail address, phone number, VAT identification number (optional) and your message – in order to handle and answer your enquiry. We are notified of enquiries received by e-mail (see section 8). The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or the initiation of a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the data once your enquiry has been conclusively dealt with, unless statutory retention obligations prevent this.

11. Product reviews

You can review products in our shop. In doing so, we process your name, your e-mail address, your star rating, the title and text of the review, the product reviewed, the language and the time of submission. Only the name you provide, the review itself and the date – and, where applicable, a reply from us – are published; instead of your full name you can also enter just your first name or a pseudonym. Your e-mail address is not published.

We use your e-mail address to check whether a paid order of the reviewed product exists under this address; if so, we mark the review as a “verified purchase”. We also use the e-mail address for queries about your review. Every review is checked by us before publication. The legal bases are Art. 6(1)(b) GDPR (publication of your review) and our legitimate interest in genuine, verifiable reviews and in preventing misuse (Art. 6(1)(f) GDPR). The data is stored for as long as the review is published; you can request the deletion of your review at any time.

12. Withdrawals, returns and complaints

If you declare a withdrawal via our withdrawal function “Withdraw from contract”, we process your name, the order number, your e-mail address, the affected items if specified, and the date and time of receipt. We need this data to assign the withdrawal to your order, to send you a confirmation of receipt by e-mail without delay and to process the reversal, including the refund. The same applies to return and complaint requests that you submit via your customer account, including the reasons and descriptions you provide. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory obligation to confirm receipt and to document, Section 356a German Civil Code, BGB).

13. Order tracking

On our page Track your order you can check the status of your order even without a customer account. To do so, you enter your order number and the e-mail address used for the order. We use this information exclusively to find the order, to verify that you are entitled to view it and to display the order and shipment status. The legal basis is Art. 6(1)(b) GDPR.

14. Retention period

We only store personal data for as long as is necessary for the respective purpose. When the purpose no longer applies, the data is deleted unless statutory retention obligations prevent this. Under German commercial and tax law (Section 257 HGB, Section 147 AO), we are obliged to retain certain documents: commercial and business letters for six years, accounting vouchers (e.g. invoices) for eight years, and books of account and annual financial statements for ten years. During these periods, processing is restricted to fulfilling the retention obligations. In addition, we store data relating to your order for as long as claims arising from the contract (e.g. warranty claims) can be asserted.

15. Automated decision-making

We do not carry out solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR. However, our payment service provider Stripe carries out automated risk assessments of payment transactions to prevent fraud; this may result in a payment being declined. If you choose a Klarna payment method, Klarna carries out an automated identity and credit check, the result of which determines whether the desired Klarna payment method is available to you. These decisions are necessary for entering into and performing the contract (Art. 22(2)(a) GDPR). You have the right to obtain human intervention from the respective provider, to express your point of view and to contest the decision. Of course, you can also choose a different payment method in this case.

16. Obligation to provide data

The provision of your data is neither required by law nor by contract. However, without the information marked as required in the ordering process, we cannot conclude and perform a contract with you. The same applies to the mandatory fields in our forms.

17. Your rights

You have the following rights with regard to the personal data concerning you:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.

An informal message to the contact details above is sufficient to exercise your rights.

Right to object under Art. 21 GDPR

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). You can contact in particular the supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement. A list of the German data protection supervisory authorities is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

18. Changes to this privacy policy

We will adapt this privacy policy if our data processing or the legal situation changes. The version published on this website at the time applies.

Last updated: September 2026