We are pleased that you are visiting our shop. The protection of your privacy is very important to us. Below, we will inform you in detail about how we handle your data.

 

1. Who we are (Controller)

 

The controller for data processing on this website, in the sense of the General Data Protection Regulation (GDPR), is:

hiBALI Jewelry and Accessory Shop Owner Sanja Beretta (née Sorgenfrey) Wölberstieg 1 20457 Hamburg Germany

Phone: 01575.4792106 Email: join@hibali.de

We have not appointed an external data protection officer. For any questions, you can contact us directly using the contact details provided above.

 

2. Hosting by Shopify

 

Our online shop is hosted on the platform of Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada. Your data is stored on Shopify's servers. Shopify provides us with the technical infrastructure for our shop. As Shopify is a Canadian company, data is also transferred to countries outside the EU (third countries). Canada has an adequacy decision from the EU Commission, which states that an adequate level of data protection exists there. Additionally, Shopify secures data transfer through so-called standard contractual clauses. Further information can be found in Shopify's privacy policy: https://www.shopify.de/legal/datenschutz.

 

3. Access Data and Hosting

 

You can visit our website without providing any personal information. Each time a web page is accessed, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. This data is used exclusively to ensure the smooth operation of the site and to improve our offer. This serves, according to Art. 6 para. 1 sentence 1 lit. f GDPR, the protection of our legitimate interests, which are overriding in a balancing of interests, in a correct presentation of our offer.

 

4. Data Collection and Processing for Contract Fulfillment

 

We collect personal data when you voluntarily provide it to us as part of your order or when contacting us (e.g., via contact form or email). Mandatory fields are marked as such, as in these cases we urgently need the data for contract fulfillment or to process your contact request, and you cannot send the order or contact request without providing them. Which data is collected is evident from the respective input forms.

We use the data you provide for contract fulfillment and processing your inquiries in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.

 

Disclosure to Shipping Service Providers

 

For contract fulfillment, we pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods.

Use of easyDHL To create shipping labels, we use the "easyDHL" app. In this process, the data necessary for shipping (name, address, order number) is transmitted to DHL's interfaces. This serves to fulfill the contract according to Art. 6 para. 1 lit. b GDPR.

Shipping by DHL Shipping is carried out by DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn. We transmit your email address to DHL so that they can inform you about the status of the shipment (tracking/package announcement), provided you have agreed to this in the checkout (Art. 6 para. 1 lit. a GDPR). Otherwise, the data is only passed on for delivery in accordance with Art. 6 para. 1 lit. b GDPR.

 

5. Data Processing for Payments

 

Various payment methods are available in our shop. Processing depends on the chosen payment method.

Shopify Payments We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2, Ireland. If you choose a payment method offered via Shopify Payments (e.g., credit card, Apple Pay, Google Pay), payment processing is carried out by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Your data is transmitted to Stripe in this process. The legal basis is Art. 6 para. 1 lit. b GDPR (contract fulfillment).

PayPal When paying via PayPal, we transmit your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg as part of the payment processing. The transfer is made in accordance with Art. 6 para. 1 lit. b GDPR and only to the extent necessary for payment processing.

Klarna If you select a Klarna payment service (e.g., invoice purchase), payment processing is carried out by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. To process the payment and carry out an identity and credit check, your data will be transmitted to Klarna. Further information can be found in Klarna's privacy policy.

 

6. Email Marketing (Newsletter)

 

Email advertising with newsletter registration If you sign up for our newsletter, we will use the data required for this or separately provided by you to send you our email newsletter regularly based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

You can unsubscribe from the newsletter at any time either by sending a message to the contact option described below or via a dedicated link in the newsletter. After unsubscribing, we will delete your email address from the recipient list, unless you have expressly consented to further use of your data.

Shipping service provider Klaviyo Our newsletters are sent via the service provider “Klaviyo”, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA. Klaviyo processes your data in the USA. We have concluded a data processing agreement with Klaviyo which contains so-called standard contractual clauses of the EU Commission to ensure an adequate level of data protection. Klaviyo uses this data for sending and statistical analysis of the newsletter on our behalf. For analysis purposes, the sent emails contain so-called web beacons or tracking pixels, which indicate whether and when an email was opened.

 

 

7. Product Reviews (Yotpo)

 

We use the tool Yotpo to collect reviews for our products (provider: Yotpo Inc., 400 Lafayette Street, 4th Floor, New York, NY 10003, USA). After your order, we may send you an email asking you to review your purchase. For this purpose, your email address, name, and order data will be transmitted to Yotpo. This is based on our legitimate interest in customer feedback and marketing (Art. 6 para. 1 lit. f GDPR) or your consent, if requested. Data transfer to the USA is secured by standard contractual clauses.

 

8. Cookies and Consent Management

 

To make visiting our website attractive and to enable the use of certain functions, we use cookies. We use the consent management tool Pandectes GDPR Compliance to obtain your consent to store certain cookies on your device or to use certain technologies and to document this in compliance with data protection regulations. When you enter our website, a cookie is stored in your browser, which stores the consents you have given or the revocation of these consents. The legal basis for this is Art. 6 para. 1 lit. c GDPR (legal obligation to prove consent).

You can change your settings at any time via the "Cookie Settings" link in the footer or via the fingerprint icon on our page.

 

9. Web Analysis and Tracking

 

Google Analytics 4 If you have given your consent (Art. 6 para. 1 sentence 1 lit. a GDPR), this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited. The service enables an analysis of your use of the website (including page views, bounce rates, dwell time). The information generated by cookies is usually transferred to a Google server in the USA and stored there. We use the IP anonymization function. Your IP address will be truncated by Google within the EU. You can revoke your consent at any time with effect for the future via our cookie settings.

Hotjar We use Hotjar (Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta) to better understand the needs of our users and to optimize the offering and experience on this website. With the help of Hotjar's technology, we gain a better understanding of our users' experiences (e.g., how much time users spend on which pages, which links they click, what they like and dislike, etc.). Hotjar works with cookies and other technologies to collect data about the behavior of our users and about their end devices. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR.

 

10. Online Marketing and Pixels

 

Google Ads Remarketing We use Google Ads to promote our products on external websites. If you have consented, we use the remarketing tool to re-target you if you have visited our shop. Legal basis: Art. 6 para. 1 lit. a GDPR.

Meta Pixel (formerly Facebook Pixel) Within our online offering, the "Meta Pixel" of the social network Facebook/Instagram (Meta Platforms Ireland Limited) is used. The Meta Pixel enables us to define the visitors to our online offering as a target group for displaying advertisements (so-called "Facebook Ads" / "Instagram Ads"). Accordingly, we use the Meta Pixel to display the ads placed by us only to those users who have also shown an interest in our online offering. Processing is based on your consent (Art. 6 para. 1 lit. a GDPR), which you have given in the cookie banner.

 

TikTok Pixel We use the "TikTok Pixel" from the provider TikTok (for EU users: TikTok Information Technologies UK Limited) on our website. This helps us to measure the effectiveness of our TikTok ads and to optimize our ads for visitors who have shown interest in our products. Data may be transferred to the USA or other third countries. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR.

 

11. Social Media Integration

 

Instagram Feed (Mageplaza) Functions of the Instagram service are integrated into our website (e.g., display of current posts). This content is loaded directly from Meta's (Instagram) servers. When you access this page, your IP address and possibly other data are transmitted to Instagram, even if you do not have an Instagram profile. This serves our legitimate interest in an appealing presentation of our products (Art. 6 para. 1 lit. f GDPR).

 

12. Your Rights and Contact Options

 

You have the following rights:

  • Right to information about your data stored by us.

  • Right to rectification of inaccurate data.

  • Right to erasure of your data.

  • Right to restriction of processing.

  • Right to data portability.

  • Right to object: If we process data to protect our legitimate interests, you can object to this processing for reasons arising from your particular situation.

For questions regarding the collection, processing, or use of your personal data, for information, rectification, restriction or erasure of data, as well as revocation of granted consents, please contact us directly using the contact details in our imprint.