Privacy Policy

The controller responsible for data processing in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection regulations is:

Kianoush Mohammadian

Bellevue 35

22301 Hamburg

Germany

Phone: +49 176 216 33 208

E-mail: customercare@hapishi.shop

Website: https://www.hapishi.shop

Scope of Processing

We only process our users' personal data to the extent necessary to provide a functional website and our content and services. In principle, we only process personal data with the user's consent. An exception applies when prior consent cannot be obtained for factual reasons and the processing is permitted by law.

Legal Bases

If we obtain the data subject's consent, Art. 6 (1) (a) GDPR serves as the legal basis.

For processing operations that are necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

If the processing is necessary for compliance with a legal obligation to which we are subject, Art. 6 (1) (c) GDPR serves as the legal basis.

If the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 (1) (f) GDPR serves as the legal basis.

Erasure and Retention Periods

Personal data will be erased or blocked as soon as the purpose of storage ceases to apply. Further storage may occur if this is required by European or national legal provisions. The data will also be erased once a statutory retention period has expired, unless further storage is necessary for the conclusion or fulfillment of a contract.

Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify receives your personal data and acts as a processor on our behalf.

This is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, not having to maintain our own shop infrastructure. We have concluded a data processing agreement (DPA) with Shopify in accordance with Art. 28 GDPR. Shopify may also process your data in the United States.

Shopify has implemented standard contractual clauses in accordance with Art. 46 para. 2 lit. c GDPR as appropriate safeguards for the transfer of personal data to third countries. Further information on Shopify's privacy practices: https://www.shopify.com/legal/privacy

For order processing, we transmit the data required for delivery (name, delivery address, and, if applicable, telephone number) to our dropshipping suppliers, who ship the goods directly to you. These suppliers are:

• zoodrop.de (Operator and contact person for data protection: see zoodrop.de website)
• vandermeerrotterdam.de (Operator and contact person for data protection: see vandermeerrotterdam.de website)

The legal basis for this transmission is Art. 6 para. 1 lit. b GDPR (performance of a contract). We have concluded data processing agreements with both service providers in accordance with Art. 28 GDPR or will conclude them.

Note (Action required): Please ensure that data processing agreements (DPAs) with zoodrop.de and vandermeerrotterdam.de are in place before commissioning, as required by Art. 28 GDPR, as soon as a service provider receives personal data from customers (name, address).

What data do we process?

When you place an order, we collect and process the following personal data:

• First name and last name
• Delivery address and, if different, billing address
• E-mail address
• Phone number
• Payment data (processed directly by the payment service provider; not stored by us)
• Order history and order contents
• IP address at the time of the order

Purpose and legal basis

Data processing is carried out for the fulfillment of the purchase agreement (Art. 6 (1) (b) GDPR), for the fulfillment of legal obligations such as retention obligations under German commercial and tax law (Art. 6 (1) (c) GDPR), and for the assertion, exercise or defense of legal claims (Art. 6 (1) (f) GDPR).

Retention period

Order data is retained for up to 10 years in accordance with legal retention obligations (§ 147 Tax Code / AO; § 257 Commercial Code / HGB). After the retention period has expired, the data will be routinely deleted, unless further retention is necessary.

Payment processing in our shop is carried out by external payment service providers. Payment data (e.g. credit card details, PayPal account information) is processed exclusively by these providers; we do not store any complete payment data ourselves.

Note (to be completed): Please list all payment service providers actually used (e.g. Shopify Payments / Stripe, PayPal, Klarna) and provide links to their respective privacy policies. This information is mandatory according to Art. 13 GDPR.

If you contact us by e-mail or telephone, the data you provide (e-mail address, name, telephone number if applicable, and the content of your inquiry) will be stored for the purpose of processing your inquiry and for any follow-up questions.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in processing your inquiry) as well as Art. 6 para. 1 lit. b GDPR, provided the inquiry is aimed at concluding a contract.

Data will be deleted as soon as it is no longer required for the purpose for which it was collected, but no later than after three years, unless there are statutory retention obligations.

Our website uses cookies, small text files that are stored on your device. We distinguish between the following types:

• Technically necessary cookies: Required for the operation of the shop (e.g. shopping cart, session management). Legal basis: Art. 6 (1) (f) GDPR. No consent required.
• Analytics cookies: These are only set with your explicit consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time via our cookie banner.
• Marketing cookies: These are only set with your explicit consent. You can refuse or withdraw your consent at any time.

You can set your browser to inform you about cookies, to allow them only in individual cases, to reject cookies in certain cases or generally, or to activate the automatic deletion of cookies when you close the browser.

Note (to be completed): Please list all third-party tools used (e.g., Google Analytics, Google Ads, Meta Pixel, Klaviyo for newsletters, etc.). Each service must be listed individually with its purpose, legal basis, retention period, and a link to the provider's privacy policy. This is one of the most common causes of cease-and-desist letters in German e-commerce. No such tools should be active until this section is completed.

You have the following rights concerning your personal data:

Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and to the information listed in Art. 15 GDPR.

Right to Rectification (Art. 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or to have incomplete data completed.

Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data if one of the reasons listed in Art. 17 GDPR applies and processing is no longer necessary.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR is met.

Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format.

Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Hamburg is:

The Hamburg Commissioner for Data Protection and Freedom of Information

(Hamburger Beauftragter für Datenschutz und Informationsfreiheit)

Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany

Phone: +49 40 428 54 4040

E-mail: mailbox@datenschutz.hamburg.de

Website: https://datenschutz.hamburg.de

During your visit to the website, we use SSL/TLS encryption (Secure Socket Layer / Transport Layer Security) with the highest level of encryption supported by your browser, usually 256-bit encryption. You can recognize whether an individual page is transmitted encrypted by the symbol of a closed padlock in the address bar of your browser.

In addition, we implement appropriate technical and organizational security measures (TOMs) to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, and unauthorized access by third parties.

This privacy policy is currently valid as of May 2026. As our website and services evolve, or due to changes in legal regulations or official requirements, it may become necessary to adapt this privacy policy. The current version can be accessed and printed at any time at https://www.hapishi.shop.

Privacy Inquiries

For questions about data protection, exercising your rights, or submitting a complaint, please contact:

Kianoush Mohammadian

Bellevue 35, 22301 Hamburg, Germany

E-mail: customercare@hapishi.shop

Phone: +49 176 216 33 208