Privacy policy

1. Who is responsible

The controller for data processing on this website is:

[Owner / company name]
[Business address]
Email: info@punjilo.com

2. What we collect and why

When you order we collect your name, email address, delivery address, optional phone number and the items you buy. We need this to process the order and deliver it (Art. 6(1)(b) GDPR). We keep order data for as long as German tax and commercial law requires, usually 6 to 10 years (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB).

Payments are handled by the payment provider you choose. We pass on the data needed for the payment (name, email, amount, order number, delivery address for PayPal):

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (cards, Apple Pay, Google Pay). Your card details go directly to Stripe; we never see them.

These providers may also process data in the USA; where they do, they rely on the EU–US Data Privacy Framework or the EU standard contractual clauses.

Bank transfer: we see the name and account details shown on the incoming payment.

Emails about your order (confirmation, shipping, refunds) are sent through our email service provider Resend (Resend, Inc., USA; EU standard contractual clauses).

Newsletter: only if you sign up and confirm by clicking the link in our confirmation email (double opt-in, Art. 6(1)(a) GDPR). We store your email address and the time of sign-up and confirmation. You can unsubscribe at any time via the link in every newsletter or by writing to us.

Withdrawal function: if you withdraw from a contract through our online form, we store your name, the order details and your email address to process the withdrawal and send you the receipt (Art. 6(1)(c) GDPR).

Reviews: to write a review you confirm your order with its number and email address, so we can show that the review comes from a real buyer. We publish your review with the name you choose (never your email address), your rating, text, size, fit and any photos you add (Art. 6(1)(a) GDPR). You can ask us to delete your review at any time. If you tick "ask me for a review" at checkout, we send you one email after delivery with links to review your items (Art. 6(1)(a) GDPR); you can withdraw this consent at any time by replying to any of our emails.

"Email me when it's back": if you ask to be told when a sold-out size is back, we store your email address and send you one email for that size (Art. 6(1)(a) GDPR). Then the request is finished.

Cart reminder: only if you tick "send me one reminder" at checkout, we store your email address, first name and cart and send you one reminder email if you don't complete the order (Art. 6(1)(a) GDPR). No reminder is sent if you order. You can withdraw this consent at any time by writing to us.

Gift cards: when you buy a gift card, we use the recipient's name and email address, your name and your message to send the gift card to the recipient (Art. 6(1)(b) GDPR). Please only enter the details of people who would expect a gift from you.

Customer account: if you create an account, you log in with a one-time link sent to your email address (no password). We store your email address, your name, the addresses you choose to save and your orders, so you can see your order history and order again quickly (Art. 6(1)(b) GDPR). You can ask us to delete your account at any time.

Punji points: customers earn points for paid orders. We record the points earned and used for each order with your customer record (Art. 6(1)(b) GDPR).

"Email me when it drops": if you ask to be told when a limited drop goes on sale, we store your email address and send you one email when it starts (Art. 6(1)(a) GDPR).

Order tracking: the order number and email address you enter on the tracking page are only used to find your order and are not stored.

Wishlist and size finder: your wishlist is stored only in your own browser. The height and weight you enter in "Find my size" are used only in your browser and are not sent to us.

Instagram: our homepage shows pictures from our Instagram account. They are stored on our own server, so no data is sent to Instagram when you view them. Only if you click a picture or "Follow us", you go to Instagram (Meta Platforms Ireland Ltd.), where Instagram's privacy policy applies.

Contact: if you email us, we use your message only to answer it.

3. Hosting

This website runs on Vercel (Vercel Inc., USA) and the database is hosted by Neon in Frankfurt, Germany. When you visit the site, the server automatically records technical data such as your IP address, browser and time of access to keep the site secure and working (Art. 6(1)(f) GDPR). These logs are deleted after a short time.

Visitor statistics: to see how many people visit the shop and which pages are popular, our own server counts page views, without cookies and without any outside analytics company. For each view we store the page, the website you came from (only its name, e.g. instagram.com), country, device type (phone/computer) and an anonymous number made from your IP address and browser together with a secret that changes every day. The IP address itself is never stored, and the number can't be traced back to you or linked across days. The data is deleted after 13 months (Art. 6(1)(f) GDPR; our legitimate interest is improving the shop). If your browser sends a "Do Not Track" or "Global Privacy Control" signal, nothing is counted.

4. Cookies and local storage

We don't use advertising or tracking cookies, and no outside analytics tools. We only use what is technically necessary to provide the shop (§ 25(2) no. 2 TDDDG):

punji_lang (cookie, 1 year): remembers whether you use the shop in English or German.
punji_account (cookie, 60 days): keeps you logged in, only if you log in to your account.
Shopping cart and wishlist (local storage in your browser): so they are still there when you come back.

5. Your rights

You have the right to access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future. Just write to info@punjilo.com.

You also have the right to complain to a data protection supervisory authority, for example the one in the German state where we are based.