Privacy Policy | Matinata Skincare

Controller

Boll & Boll Produkte GbR, Wormser Str. 173, 55130 Mainz, Germany. Email: natalie@matinataskincare.com. Telephone: +49 171 270 6558. Represented by Natalie Boll.

We are not legally required to appoint a data protection officer. Please send all privacy enquiries to the address above.

Legal bases we rely on

Art. 6(1)(a) GDPR — your consent (cookies, newsletter, marketing measurement).
Art. 6(1)(b) GDPR — performance of the purchase contract (orders, delivery, customer account, support).
Art. 6(1)(c) GDPR — legal obligations (tax and commercial record keeping, § 147 AO, § 257 HGB).
Art. 6(1)(f) GDPR — our legitimate interests (secure operation of the site, fraud prevention, defence against attacks and abuse). We balance these against your interests in each case.

Visiting the website: server logs and security

Data: IP address, date and time of the request, requested URL, referrer, browser and operating system, and status/volume of the transferred data.
Purpose: delivering the website, ensuring stability and security, detecting and defending against attacks, bot filtering and abuse prevention.
Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: operating a secure, available online shop and protecting it against attacks, scraping and fraudulent traffic.
Recipients: Lovable Cloud (hosting/infrastructure) and Cloudflare, Inc. (CDN and security), acting as processors.
Retention: log and security data is deleted or anonymised within 30 days at the latest, unless a specific security incident requires longer storage as evidence.

Basket and language settings

Data: the products in your basket, quantities and your language choice, stored locally in your browser (localStorage).
Purpose: keeping your basket and language while you browse and until you complete checkout.
Legal basis: Art. 6(1)(b) GDPR; the storage itself is strictly necessary within the meaning of § 25(2) no. 2 TDDDG, so no consent is required.
Retention: until you clear the basket, complete the order, or clear your browser storage.

Orders, checkout and payment

Data: first and last name, billing and delivery address, email address, telephone number (if given), order contents and value, order number, IP address at the time of ordering, and payment metadata (payment method, authorisation status). We never see or store your full card details.
Purpose: concluding and performing the purchase contract, invoicing, payment processing, chargeback handling and statutory bookkeeping.
Legal basis: Art. 6(1)(b) GDPR for the contract; Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB for invoices and accounting records; Art. 6(1)(f) GDPR for fraud and chargeback prevention.
Recipients: Shopify International Ltd. (Ireland) and Shopify Inc. (Canada) as e-commerce processor; the payment provider you choose (Shopify Payments/Stripe, PayPal, Klarna where offered) as an independent controller for the payment itself; our tax adviser and, where required, the tax authorities.
Retention: invoices and accounting-relevant order data are kept for 10 years from the end of the calendar year in which the order was placed (§ 147 AO). Data not subject to retention obligations is deleted once warranty and return periods have expired.

Fraud prevention and checkout risk checks

Data: IP address, device and browser characteristics, billing/delivery address mismatches, order frequency and value, payment authorisation results.
Purpose: identifying fraudulent orders, card testing and chargeback abuse before dispatch.
Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: preventing financial loss from fraudulent orders. No order is rejected purely by automated means with legal effect; a human always decides (see 'Automated decision-making').
Recipients: Shopify (Fraud Analysis), the chosen payment provider, Cloudflare (bot and abuse detection).
Retention: together with the order data, and in any event no longer than the statutory retention period for the order.

Customer accounts

Data: email address, name, delivery addresses, order history and login metadata (last login, login codes). Shopify customer accounts use email login codes rather than passwords.
Purpose: giving you access to your orders and addresses and making repeat purchases easier.
Legal basis: Art. 6(1)(b) GDPR.
Recipients: Shopify as processor.
Retention: until you delete your account or ask us to delete it; order documents subject to statutory retention remain stored for the period described above.

Contacting us

Data: your name, email address, the content of your message and any attachments.
Purpose: answering your enquiry and documenting it where it concerns an order.
Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries about our products).
Retention: enquiries are deleted six months after the matter is closed, unless commercial or tax retention obligations apply.

Product reviews (Judge.me)

Data: email address, first name or initials, order number, rating, review text and any photographs you upload.
Purpose: sending a review invitation after purchase and publishing reviews on the product pages.
Legal basis: Art. 6(1)(a) GDPR for the review invitation email and for publishing your review; publication only ever shows the name or initials you provide.
Recipients: Judge.me Ltd. (United Kingdom, covered by the UK adequacy decision) and its US infrastructure, as processor.
Retention: published reviews remain online until you ask us to remove them; review invitations and unsent review data are deleted after 12 months.

Newsletter and email marketing (Klaviyo)

Data: email address, first name (optional), date and time of sign-up, confirmation date and IP address used for the double opt-in, plus engagement data (opens, clicks, links followed).
Purpose: sending our newsletter with news about formulas, rituals and offers, and measuring whether it is read.
Legal basis: Art. 6(1)(a) GDPR. We use double opt-in: your subscription is only active once you confirm the link in the confirmation email. We store the sign-up and confirmation record as proof of consent.
Profiling: with your consent, Klaviyo also records products you view, items you add to the basket and purchases made, and uses this to personalise the content and timing of our emails. This has no legal effect on you and you can object or withdraw consent at any time.
Recipients: Klaviyo, Inc. (USA) as processor.
Withdrawal: every email contains a one-click unsubscribe link; you can also write to us. Withdrawal has no effect on processing already carried out.
Retention: subscription data is deleted immediately after unsubscribing, except the consent record (sign-up and confirmation), which we keep for up to three years afterwards as proof of lawful consent.

Onsite tracking with Klaviyo

Data: pseudonymous profile identifier (__kla_id), pages and products viewed, basket events, and — if you are a subscriber — the link to your email profile.
Purpose: relevant email content such as reminders about products you looked at.
Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG. The script is only loaded after you accept cookies.
Retention: up to 2 years, or until you withdraw consent or ask for deletion of your profile.

Meta Pixel (Facebook / Instagram advertising)

Data: cookie identifier (_fbp), IP address, browser and device data, pages viewed, product views, add-to-cart and checkout-start events.
Purpose: measuring the performance of our advertising, building custom and lookalike audiences and showing you our ads on Meta platforms (behavioural analysis for advertising).
Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG. The pixel script is not loaded at all until you accept cookies.
Recipients: Meta Platforms Ireland Ltd. and Meta Platforms, Inc. (USA). For the collection and transmission of this data we and Meta act as joint controllers within the meaning of Art. 26 GDPR; the further processing by Meta for its own purposes is Meta's sole responsibility.
Retention: up to 2 years at Meta, unless deleted earlier; you can withdraw consent at any time through 'Cookie settings' in our footer.

Google Ads and conversion measurement

Data: cookie identifiers (_gcl_au, _gac_*, IDE), click identifier from an ad, IP address, browser data, pages viewed and conversion events (product view, add to cart, checkout start, purchase).
Purpose: measuring which advertisements lead to orders and showing you our ads again (remarketing).
Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG. We use Google Consent Mode v2 with all storage set to 'denied' by default, and the Google tag script (googletagmanager.com) is only requested after you accept cookies — before that, no connection to Google is established from this site.
Recipients: Google Ireland Ltd. and Google LLC (USA).
Retention: advertising cookies expire after between 15 minutes and 13 months; conversion data at Google is retained for the periods set out in Google's own policies.

Shopify shop analytics and checkout tracking

Data: pseudonymous visitor identifiers (_shopify_y, _shopify_s), landing page and referrer, pages and products viewed on the shop and checkout domain, order events.
Purpose: understanding how the shop and checkout are used and measuring completed orders.
Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG for the analytics cookies; strictly necessary checkout and fraud-prevention cookies are set on the basis of Art. 6(1)(b) GDPR and § 25(2) TDDDG.
Recipients: Shopify International Ltd. (Ireland), Shopify Inc. (Canada, covered by an EU adequacy decision).
Retention: between 30 minutes and 2 years depending on the cookie; see our Cookie Policy for the full table.

Shipping

Data: name, delivery address, and — for delivery notifications — email address and/or telephone number.
Purpose: delivering your order and providing tracking information.
Legal basis: Art. 6(1)(b) GDPR.
Recipients: DHL Paket GmbH and, where used, other carriers, acting as independent controllers for the delivery.
Retention: with the order data; shipping records are deleted once statutory retention periods have expired.

Transfers to third countries and how to obtain the safeguards

Some of our processors are located in the United States or process data there (Klaviyo, Inc., Meta Platforms, Inc., Google LLC, Cloudflare, Inc., Judge.me's US infrastructure, Lovable's US infrastructure). Where a provider is certified under the EU–US Data Privacy Framework, transfers take place on the basis of the European Commission's adequacy decision (Art. 45 GDPR). Otherwise, transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with additional technical and organisational measures such as encryption in transit and at rest, data minimisation and a transfer impact assessment. Shopify Inc. is located in Canada, which benefits from an adequacy decision for commercial organisations; Judge.me Ltd. is in the United Kingdom, which is covered by an adequacy decision.

You can obtain a copy of the Standard Contractual Clauses or a description of the safeguards in place for any specific provider free of charge by writing to natalie@matinataskincare.com with the subject "Art. 46 GDPR safeguards". We will respond within one month.

Despite these safeguards, a residual risk remains that authorities in a third country may request access to data. You may withdraw your consent for all non-essential US services at any time via 'Cookie settings' in the footer.

Data processing agreements

We have concluded data processing agreements under Art. 28 GDPR with all processors named in this policy, including Shopify, Klaviyo, Judge.me, Cloudflare and our hosting provider, and we maintain a record of processing activities under Art. 30 GDPR as well as documented deletion and retention rules.

Retention at a glance

Invoices and accounting data: 10 years (§ 147 AO, § 257 HGB).
Order and delivery data not subject to retention duties: deleted after warranty and return periods expire.
Server and security logs: max. 30 days.
Enquiries: 6 months after the matter is closed.
Newsletter data: deleted on unsubscribe; consent record kept up to 3 years afterwards.
Cookies and similar technologies: as stated in the Cookie Policy table (session up to 2 years).

Automated decision-making and profiling

We do not use automated decision-making that produces legal effects concerning you within the meaning of Art. 22 GDPR. Fraud scores are only indications and are always reviewed by a person before an order is cancelled. Profiling takes place solely for marketing purposes through Klaviyo, Meta and Google as described above, and only with your consent.

Is providing data mandatory?

You are not obliged to provide personal data. However, we cannot process an order without the data needed for the contract, delivery and invoicing, and we cannot send the newsletter without your email address and consent.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. Write to natalie@matinataskincare.com — we answer requests within one month and never charge for them.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

Cookies

Cookies and comparable technologies that are strictly necessary for the shop, basket and checkout are used without consent under § 25(2) TDDDG. All other cookies and scripts — Meta, Google, Klaviyo, Judge.me and Shopify analytics — are only loaded after you accept them, and you can change or withdraw that choice at any time via 'Cookie settings' in the footer. Our Cookie Policy contains a full table listing each cookie, its provider, purpose, duration, party and legal basis.