Privacy Policy

Thank you for your interest in our online shop. Protecting your personal data matters to us. Below we explain which data we process, for what purpose, on what legal basis, and what rights you have.

Version of this policy: 18 August 2026

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Ipanema Beauty UG (haftungsbeschränkt)
Pappelallee 78/79
10437 Berlin
Germany

Phone: +49 30 23326619
E-mail: support@plantsarepurple.com

Managing directors: Amadeus Auracher, Nassim Eshaghi
Commercial register: Charlottenburg Local Court, HRB 204013 B
VAT identification number: DE323613520

2. Access data and hosting

You can visit our web pages without telling us who you are. Each time a page is called up, the server automatically stores a server log file containing the name of the requested file, your IP address, the date and time of the request, the volume of data transferred and the requesting provider.

We evaluate this access data solely in order to ensure trouble-free operation of the site and to improve our offering. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the correct and secure presentation of our offering. Access data is deleted no later than seven days after the end of your visit.

Our online shop is operated by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, as our processor. Shopify also processes data outside the European Union. Transfers to the Canadian parent company Shopify Inc. are based on the European Commission's adequacy decision for Canada. Intra-group transfers to other third countries are based on Shopify's binding corporate rules, and otherwise on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Further information: https://www.shopify.com/legal/privacy

3. Data processing for order handling and contact

We collect personal data when you provide it to us voluntarily in the course of your order or when contacting us. Mandatory fields are marked as such, because we need that data in order to perform the contract or to deal with your enquiry. Which data is collected follows from the respective input forms.

The legal basis is Art. 6(1)(b) GDPR for performing the contract and answering your enquiries. If you open a customer account, we additionally process your data on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Once the contract has been fully performed or your customer account has been deleted, we restrict the processing of your data and delete it after the retention periods under tax and commercial law have expired. Under § 147 of the German Fiscal Code (Abgabenordnung) and § 257 of the German Commercial Code (Handelsgesetzbuch) these periods are generally ten years. You can delete your customer account at any time, either using the function provided in the account or via the contact details given below.

4. Recipients of your data

We pass on your data only to the extent necessary for the purposes described. Below we name the service providers who receive personal data about you. Where a provider processes data outside the European Union, we state the basis of that transfer.

4.1 Shop operation, payment and invoicing

• Shopify International Limited, Ireland, operation of the online shop. Bases as described under section 2.
• Shopify Payments, provided by Shopify International Limited, Ireland, processing of card payments as well as Apple Pay, Google Pay and Shop Pay.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, payment processing if you choose PayPal. In this respect PayPal acts as a controller in its own right. No transfer to a third country takes place on our part.
• Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, processing of payments by iDEAL, Bancontact and Klarna. For Klarna payments Mollie forwards the data required for the payment to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna acts as a controller in its own right and carries out an identity and credit check for invoice and instalment payments. Details: https://www.mollie.com/privacy and https://www.klarna.com/international/privacy-policy/
• Posity Oy (Upnova), Taavinkuja 6 A 21, 00380 Helsinki, Finland, display of the shopping cart and of product offers within the shop.
• Consentmo, management of your cookie consent. This service is technically necessary in order to record and honour your choice.
• easybill GmbH, Düsselstraße 21, 41564 Kaarst, Germany, creation and dispatch of invoices.
• pathway solutions GmbH, Germany, preparation of accounting records for our financial bookkeeping (DATEV export).
• Our tax adviser and the tax authorities, where required by law.

4.2 Shipping, fulfilment and returns

• Hive Technologies GmbH, Maulbeerstraße 7, 15834 Rangsdorf, Germany, warehousing, picking and dispatch of your order.
• DHL (Deutsche Post AG / DHL Group), Germany, delivery of your order.
• 8returns GmbH, Germany, handling of returns through our returns portal.

4.3 Customer service and communication

• Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, sending our e-mails and SMS messages and managing the associated recipient data. Klaviyo is certified under the EU-US Data Privacy Framework, for which the European Commission has established an adequate level of protection for certified companies. The European Commission's standard contractual clauses apply in addition. Details: https://www.klaviyo.com/legal/privacy-notice
• Gorgias Inc., 768 Harrison Street, San Francisco, CA 94107, USA, handling your support requests by e-mail and chat. The transfer to the USA is based on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

4.4 Product reviews

• Judge.me Limited, United Kingdom, collection and display of product reviews. An adequacy decision of the European Commission is in place for the United Kingdom.

4.5 Analytics and advertising

We use the following services only if you have given your consent through our consent banner. Details in section 7.

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, web analytics (Google Analytics) and advertising (Google Ads).
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, reach measurement and advertising (Meta pixel).
• Triple Whale Inc., USA, evaluation of shop and marketing metrics.
• Commerce Media Tech sp. z o.o. (Voluum), Poland, measurement of advertising campaigns.
• Become Technological Solutions Ltd. (BeProfit), Israel and USA, evaluation of order and cost figures. Transfers to Israel are based on the European Commission's adequacy decision for Israel, transfers to other third countries on the European Commission's standard contractual clauses.

Where providers of the services named above transfer data to the USA, this is based either on a certification under the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR. We will provide you with copies of the standard contractual clauses on request.

5. E-mail advertising

5.1 Newsletter with your consent

If you sign up for our newsletter, we use the data required for that purpose, or separately provided by you, in order to send you our e-mail newsletter regularly. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 2 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG), the provision governing advertising by electronic mail.

You can unsubscribe at any time free of charge, using the unsubscribe link at the end of every advertising e-mail or the contact details given below.

5.2 Advertising to existing customers without separate consent

If you have placed an order with us, we also use your e-mail address to send you advertising for our own similar goods, even if you have not separately signed up for the newsletter. The basis for this is § 7(3) UWG, the German provision that permits advertising to existing customers, in conjunction with Art. 6(1)(f) GDPR, our legitimate interest in direct marketing to our customers.

You can object to this use at any time and free of charge, without incurring any costs other than the transmission costs at basic rates. Please use the unsubscribe link in any advertising e-mail or write to support@plantsarepurple.com. After your objection we will no longer use your e-mail address for advertising.

5.3 Storage after an objection

If you object to advertising or unsubscribe, we add your e-mail address to an internal suppression list and store it there permanently. This is done for the sole purpose of giving lasting effect to your objection. Deleting the address entirely would mean that we could accidentally contact you again. The legal basis is Art. 6(1)(c) and (f) GDPR.

6. Postal advertising and your right to object

We reserve the right to use your first name, surname and postal address for our own advertising purposes, for example to send you offers by post. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in addressing our customers with advertising. You can object to this use at any time via the contact details given below.

7. Cookies and similar technologies

We use cookies and comparable technologies on our website. Cookies are small text files stored on your device. Some are deleted at the end of the browser session (session cookies), others remain on your device and allow your browser to be recognised on your next visit (persistent cookies).

We set technically necessary cookies, without which the shop does not work, on the basis of § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG), the German implementation of the ePrivacy rules on terminal equipment. We set all other cookies and technologies, in particular for analytics and advertising, only with your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR.

You give your consent through our consent banner. You can withdraw it at any time with effect for the future by calling up the cookie settings on our website again and changing your selection. The withdrawal does not affect the lawfulness of processing carried out up to that point.

You can also configure your browser to inform you when cookies are set or to reject cookies in general. If cookies are not accepted, the functionality of our website may be limited.

8. Profiling in e-mail marketing

Based on your order and interaction history, our e-mail system calculates statistical predictions, for example an expected date of a next order or an estimated likelihood of churn. We use these values solely in order to control the timing and content of our e-mails. This constitutes profiling within the meaning of Art. 4(4) GDPR. The legal basis is Art. 6(1)(f) GDPR.

No automated decision in an individual case producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place.

9. Social media

We maintain profiles on Instagram, TikTok, YouTube and LinkedIn in order to provide information about our products and to be in contact with our customers. When you visit these profiles, your data may be collected by the respective platform operators for market research and advertising purposes and processed into usage profiles. The legal basis is Art. 6(1)(f) GDPR, unless you have given your consent to the platform operator, in which case Art. 6(1)(a) GDPR is the legal basis.

For the insights data of our Meta profile there is a joint controllership arrangement pursuant to Art. 26 GDPR: https://www.facebook.com/legal/terms/page_controller_addendum

Details on the processing by the platform operators and the settings available to you there:

• Instagram: https://www.facebook.com/privacy/policy
• TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
• YouTube: https://policies.google.com/privacy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

10. Your rights

As a data subject you have the following rights against us:

• Access pursuant to Art. 15 GDPR to the personal data we process about you, including a copy of that data.
• Rectification of inaccurate data and completion of incomplete data pursuant to Art. 16 GDPR.
• Erasure pursuant to Art. 17 GDPR, unless the processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
• Restriction of processing pursuant to Art. 18 GDPR.
• Data portability pursuant to Art. 20 GDPR.
• Withdrawal of consent given pursuant to Art. 7(3) GDPR, with effect for the future.
• Objection pursuant to Art. 21 GDPR.

Right to object

Where we process personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation.

Where we process your data for direct marketing purposes, you may object at any time without giving reasons. After your objection we will no longer process your data for that purpose.

Right to lodge a complaint

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, at your choice the authority of your place of residence, your place of work or our registered office. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
https://www.datenschutz-berlin.de

11. Contact for data protection matters

If you have questions about the processing of your personal data or wish to exercise your rights, please contact:

Ipanema Beauty UG (haftungsbeschränkt)
Pappelallee 78/79, 10437 Berlin, Germany
E-mail: support@plantsarepurple.com