Privacy policy

Last updated: 26 September 2026

This privacy policy describes how personal data is processed when you visit our online store, place orders, contact us or use our store's features. Using the store does not, in itself, constitute consent to processing that requires your consent.

1. Data controller and contact details

The controller responsible for Palvora's processing of personal data is:
Sargis Hovhannisyan, trading as Palvora (sole trader)
Breite Hecke 2
44532 Lünen
Germany
Email: info@palvora.de
Telephone: +49 177 6424913

2. Visiting the store, hosting and security

When you access our store, technical connection data is processed, including your IP address, browser and device information, the pages requested, and the time and technical details of each request. This data enables us to deliver the website, resolve errors and prevent misuse. To the extent that processing is necessary for these purposes, it is based on Article 6(1)(f) GDPR. Our legitimate interest is to operate the store reliably and securely. The information below about consent and individual services applies to any further analysis of how the store is used.

Our store runs on the Shopify platform. The primary contracting entity for European merchants is Shopify International Limited in Ireland. Shopify processes data to provide the store, checkout and other platform features we use. Processing on our behalf is governed by the Shopify Data Processing Addendum.

3. Orders, customer accounts, payments and communications

When you place an order, we process information including your name, billing and delivery addresses, email address, telephone number where applicable, ordered items, order total and payment status. We receive this data from you and, as part of processing your order, from Shopify, your selected payment provider and the delivery provider used. The legal basis is Article 6(1)(b) GDPR. We cannot fulfil the contract without the order details marked as required.

If you use a customer account, the information necessary to sign in and manage the account, together with the orders associated with it, is processed. Your payment is handled through the payment method you select at checkout. The relevant payment provider receives the data needed to process the payment; its own privacy notice also applies to processing for which it acts as an independent controller. We receive the payment status and transaction reference so that we can match your payment to your order. The legal basis for the necessary processing of payment and account data is Article 6(1)(b) GDPR.

Shopify Payments: For payments through Shopify Payments, Shopify International Limited processes the necessary contact, billing, payment and transaction data. Shopify uses additional payment processors depending on the payment method; its official list of providers for Germany includes Stripe Payments Europe, Limited. In addition to processing data on our behalf, these providers may fulfil their own legal obligations, particularly those relating to anti-money laundering and fraud prevention. Article 6(1)(b) GDPR is the basis for our transfer of data necessary to process your payment. Further details about the respective processing are available in the Shopify Privacy Policy and the Stripe Privacy Policy.

PayPal Express: If you choose PayPal, the contact, order and payment data needed for your payment are transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Our transfer is based on Article 6(1)(b) GDPR. PayPal also processes data as an independent controller, particularly for payment processing, fraud prevention and compliance with legal obligations. The PayPal Privacy Statement explains the legal bases, recipients, international transfers, retention periods and your rights.

When you contact us, we process your contact details and the contents of your message to respond to your enquiry. Article 6(1)(b) GDPR applies to enquiries relating to a contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in handling enquiries appropriately. Please provide only the data we need to address your enquiry.

4. Shipping and shipment tracking

We have integrated easyHermes by 247APPS to organise shipping. When we use it to process your order, the necessary order, address and shipment data is processed to create shipping labels, arrange delivery and identify the shipment. For deliveries made by Hermes, Hermes receives the information necessary for delivery, particularly the recipient's name and delivery address. The legal basis is Article 6(1)(b) GDPR. Further information: easyHermes and provider information and the Hermes privacy notice.

Our store links to Track123 shipment tracking. If you open this feature and look up a shipment, the order or shipment details you enter, together with technical connection data, are processed to provide the tracking result. This lookup provides information about your delivery and is based on Article 6(1)(b) GDPR. Further information is available in the Track123 privacy policy.

5. Online withdrawal form

We use the “EU Widerruf Button” app by 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Str. 1a, 40721 Hilden, Germany, for our online withdrawal function. When you use the form, your name, email address, order details, any details about individual items, and information about receipt of your declaration are processed. This information is used to identify and process your withdrawal and confirm its receipt. The legal bases are Article 6(1)(c) GDPR in conjunction with section 356a of the German Civil Code (BGB) and, for reversing the purchase transaction, Article 6(1)(b) GDPR.

Accessing the embedded form also involves processing the technical connection data necessary to provide the form and prevent misuse. The app uses Amazon Web Services infrastructure. Further provider information is available in its privacy policy. The app is configured to delete withdrawal records automatically after six months. This is separate from the order documents and confirmation messages we retain; the criteria in the “Retention periods” section apply to those records.

6. Cookies, similar technologies and your choices

We use Shopify's cookie banner, where you can accept or reject optional processing. You can reopen and change your choices through “Cookie preferences” in the footer of our store. Simply using the website does not replace consent.

Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to storing information on, or accessing information from, your device where consent is required. Subsequent consent-based processing of personal data is based on Article 6(1)(a) GDPR. The exemption in section 25(2) TDDDG may apply where storage or access is strictly necessary to provide a service you have expressly requested. Examples may include shopping cart and session functions. Non-essential analytics or advertising measurement does not become technically necessary simply because it is included in an app.

The following sections describe the services integrated into our store. You can change your consents for the future through the cookie preferences. For other privacy enquiries, please use the contact details above.

7. Integrated store features, reviews and analytics

Judge.me

We have integrated Judge.me, provided by Judge.me Ltd, c/o Buckworths, 1–3 Worship Street, London EC2A 2AB, United Kingdom, for review features. If you use a review feature, your display name, email address, review text, rating and any content you voluntarily submit may be processed. Technical connection and usage data is generated when the integrated features are loaded and used. Processing and displaying a review you submit serves our legitimate interest in providing authentic product information (Article 6(1)(f) GDPR). Your consent is the legal basis for non-essential analytics (Article 6(1)(a) GDPR). Judge.me states that it acts as a processor for customer data supplied by us; if you have your own account with Judge.me or contact it directly, it may process data separately as an independent controller. Further information: privacy policy and data processing and international transfers.

Sternify

We have integrated Sternify, provided by Sternify GmbH, Dresdener Ring 40, 65239 Hochheim am Main, Germany, to design and provide store features. Depending on the feature used, information such as the state of the cart or displayed elements is stored. Sternify also describes pseudonymous event data about widget views and interactions, including the event type, widget identifier, store domain and a random session identifier. Where storage is strictly necessary for a feature you request, section 25(2) TDDDG and, depending on the purpose, Article 6(1)(b) or (f) GDPR apply. Non-essential measurement is based on Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. Sternify states that it processes store visitors' data on behalf of the merchant. Further information: privacy, storage technologies and service providers.

Google Fonts through Sternify: A Sternify component loads font information from Google Fonts to display the Poppins typeface. Google receives your IP address, the requested Google URL, browser information and, where transmitted by your browser, the referring address. Google states that it uses these data to deliver and secure the service. For users in the European Economic Area, Google identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the controller. Processing by Google LLC in the United States is possible. Further information: Google Fonts FAQ, Google Privacy Policy and Google's information on international data transfers.

Noibu

Noibu, provided by Noibu Technologies Inc., Canada, is integrated for technical error and usage analysis. The provider describes processing browser and device types, page URLs, technical error messages, a browser identifier and changes to the displayed website. This information can be used to reconstruct sessions for troubleshooting. For non-essential session and usage analysis, the legal basis is your consent under Article 6(1)(a) GDPR and, where relevant device access is involved, section 25(1) TDDDG. Noibu states that it retains this analytics data for 90 days and that processing includes the use of Google Cloud and Elasticsearch in the United States. Further information: data collected and retention, sub-processors and privacy policy.

ConversionBear

A ConversionBear integration is used to display trust and payment symbols (“Trust Badges”). When this externally hosted content is requested, technical connection data, particularly your IP address and browser information, is sent to the infrastructure delivering it. The provider group identifies itself as AppHub, LLC, trading as Clearer. To the extent that data is required solely to deliver this store content, processing is based on Article 6(1)(f) GDPR and our legitimate interest in presenting the store. Any additional analytics or advertising that requires consent is subject to Article 6(1)(a) GDPR and section 25(1) TDDDG. Further provider information: Clearer / ConversionBear privacy policy.

8. Advertising, newsletters and Shopify Network Intelligence

If you subscribe to our newsletter and give your consent, we use your email address to send Palvora news and advertising. The legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time using the unsubscribe option in the relevant message or by emailing info@palvora.de. Consent and unsubscribe records may be retained to document your choices.

Meta Pixel and Conversions API

Meta Pixel and the Conversions API integration through Shopify are configured in our store. These technologies are used to measure advertising performance and attribute store events, such as page views, product views, cart actions and purchases, to advertising on Facebook and Instagram. Depending on the event, device and browser identifiers, technical connection data, event and order data, and contact details needed for matching may be processed and shared with Meta. The Conversions API allows data to be transferred between servers. The recipient is Meta, represented in the European region by Meta Platforms Ireland Limited, Ireland; further processing in the United States is possible. The legal basis for this advertising-related processing is your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to device access that requires consent. Further information: Meta privacy policy and Shopify's explanation of data sharing.

Pinterest Tag and Conversions API

The Pinterest integration in Shopify has been configured with the Pinterest Tag and a server-side connection. These are used to measure and optimise advertising, attribute store events to Pinterest ads and build advertising audiences. This may involve processing and sharing with Pinterest information about page views, searches, cart actions and purchases, together with technical connection data, browser and device identifiers, and product and order data. Hashed contact details may also be used for matching; hashing does not automatically make this information anonymous. The Conversions API allows data to be transferred between servers. The recipient of data from the European Economic Area is Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland. Further processing by Pinterest, Inc. in the United States is possible. The legal basis for this advertising-related processing is your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to device access that requires consent.

Pinterest's advertising terms provide for joint controllership with Pinterest Europe under Article 26 GDPR for the collection and transmission of activity data; this does not extend to Pinterest's subsequent processing. Details are set out in the Pinterest Joint Controller Addendum. You can change your consent for our store through the cookie preferences. You can also manage personalised advertising in your Pinterest settings. Information about Pinterest's processing, retention periods, your rights and international safeguards, including Pinterest's stated use of the EU–US Data Privacy Framework and standard contractual clauses, is available in the Pinterest privacy policy.

Shopify Network Intelligence

Shopify Network Intelligence is enabled in our store. It combines data from interactions with our store, other merchants and Shopify to provide enhanced features, particularly personalisation, service improvements and advertising. Under its terms, Shopify acts as an independent controller for these enhanced services. Shopify requires consent for personalised advertising to people in the European Economic Area. Further information about purposes, data, recipients and legal bases is provided in Shopify's Consumer Privacy Policy. You can use the Shopify Privacy Portal to exercise your privacy rights in relation to Shopify and restrict the use of your data for advertising.

9. Recipients and international processing

Data is received by the platform, payment, delivery, communications and app service providers used for the relevant purpose. We may also disclose necessary information to authorities or advisers subject to professional confidentiality obligations where this is necessary to fulfil legal obligations or establish or defend legal claims. The legal bases are Article 6(1)(c) and (f) GDPR, respectively.

The European Union is shown as our store's primary Shopify data hosting location. This does not mean that all processing takes place in Europe. Shopify and other services named above may also process data outside the European Economic Area. Shopify describes, among other mechanisms, the adequacy decision for relevant transfers to Canada and standard contractual clauses for further transfers. Further information and contractual terms: Shopify's information on international transfers and the Shopify Data Processing Addendum.

The privacy notices and data processing information published by the app providers named above explain their international processing and the safeguards they specify. Judge.me describes standard contractual clauses in its data processing agreement; Sternify and 401layers refer to adequacy decisions and standard contractual clauses, among other mechanisms. Please contact us if you have questions about recipients or the safeguards applicable to your data.

10. Retention periods

We retain personal data for as long as it is needed for the relevant purpose. Order and payment records may be subject to statutory retention periods. Accounting vouchers generally have to be retained for eight years, certain books and records for ten years, and business correspondence and other tax-relevant records generally for six years. The applicable period and its statutory starting point determine how long each record must be retained. The legal basis is Article 6(1)(c) GDPR.

Enquiries and contract-related communications are also retained where needed to address the matter or establish, exercise or defend legal claims. Relevant factors include unresolved matters and the applicable limitation periods. The legal basis is Article 6(1)(f) GDPR. After you withdraw consent to advertising, minimal suppression and evidence records may be retained to ensure that your unsubscribe request is respected and to document the earlier consent. The specific app-related retention information above applies in addition.

11. Your rights

Subject to the conditions laid down by law, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time for the future; this does not affect the lawfulness of processing carried out before withdrawal. Please send your request to info@palvora.de or to the postal address above.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. You can object to the processing of your data for direct marketing at any time without giving a reason.

You can lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. For our business location, one competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de. You do not have to contact us before lodging a complaint.

This privacy policy will be updated when the processing described here changes. The current version is available on this page.