Privacy notice
Updated: 2 October 2026
1. Controller
The controller is EATC GmbH, Karlsruher Str. 129, 01189 Dresden, Germany, represented by managing director Pryde Dobgima Fohtung. For privacy enquiries: kontakt@smarald.com, telephone +49 351 40 28 17 60.
2. Hosting and access data
We operate the Shopware shop on a server hosted by Host Europe GmbH, c/o Spaces, Gertrudenstraße 30–36, 50667 Köln, Germany. Requests involve processing IP address, time, requested URL, status code, data volume, browser information and, where applicable, referrer. This is necessary for delivery, troubleshooting and protection against attacks (Article 6(1)(f) GDPR; legitimate interest in secure operation). IP addresses are not generally anonymised. Technical logs are needed only for as long as operational and security checks require; specific incidents may require preservation until resolved or legal claims pursued. Host Europe supports hosting and operation; commissioned IT service providers may receive access where necessary.
3. Orders, accounts and contact
For enquiries, accounts, orders, delivery, payment and returns, we process names, contact details, billing and delivery addresses, company details where relevant, order items, payment and transaction status and your messages. The legal bases are Article 6(1)(b) GDPR for contracts and pre-contractual steps, (c) for legal duties and (f) for general enquiries, misuse prevention and legal claims. Required fields are marked; we cannot provide the corresponding service without the necessary information. Optional information is not a condition of purchase. An account allows you to manage orders; guest checkout is available. Passwords are stored as hashes. For online withdrawal we process your name, email, contract identification, any additional statement and the date and time of receipt to handle and acknowledge the withdrawal (Article 6(1)(b) and (c) GDPR).
4. Recipients and payment
Delivery companies, particularly DHL/Deutsche Post and GLS, receive necessary names, delivery addresses and shipment data. Tax advisers, banks, authorities and legal advisers may receive necessary data for accounting, legal records and claims (Article 6(1)(b), (c) or (f) GDPR). Advance transfers are processed through the banks involved. PayPal, cards, SEPA and wallets offered through PayPal use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Order, contact, device, IP and transaction data are processed to provide and complete the chosen payment. Payment processing relies on Article 6(1)(b) GDPR; necessary misuse prevention on (f). PayPal, participating banks and wallet providers also process data as independent controllers, including fraud prevention and, for relevant payment products, creditworthiness checks. Their own terms and privacy notices also apply. Full card details are processed through the provider’s payment fields.
AI-assisted handling of customer messages: When processing your messages about an order, our staff may have a translation or a draft reply created with the AI service Google Gemini provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For a draft reply, the message history and the order data required for it (order number, items, amounts, order, payment and shipping status, tracking number, delivery country) are transmitted; we replace your name and email address with placeholders beforehand. For a translation, only the text of the respective message is transmitted. Google processes the data as our processor under the terms for the paid Gemini API and does not use it to train its models; processing in the USA may take place on the basis of the EU–US Data Privacy Framework or standard contractual clauses. Every reply is reviewed and sent by a member of staff; no automated decisions are made. The legal basis is Art. 6(1)(b) GDPR insofar as the message concerns your order, otherwise Art. 6(1)(f) GDPR (legitimate interest in fast, multilingual customer communication).
5. Cookies and external content
Necessary storage, including sessions, baskets, sign-in and cookie choices, is based on section 25(2)(2) TDDDG; subsequent personal-data processing relies on Article 6(1)(b) or (f) GDPR according to purpose. Non-essential storage and external media are activated only with consent (section 25(1) TDDDG, Article 6(1)(a) GDPR). ‘Cookie settings’ in the footer lets you accept, reject or change optional services. Rejection does not prevent an ordinary purchase. Choices are generally stored for 30 days; session cookies end with the session. The cookie overview explains individual entries. Meta Pixel and similar advertising trackers are not configured in this shop; for Google Analytics see the following section. Fonts and our logo animation are loaded locally. After you enable optional YouTube or Vimeo videos, providers receive in particular IP address, device and request data and may use their own storage technologies. Providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (YouTube), and Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA. External linked websites are accessed only when you open the link.
Google Analytics
With your consent ("Statistics" category in the cookie settings) we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This shows us how visitors find and use our shop, for example which websites or search terms they come from, which pages they view and which orders are completed (order number, items and amount, without names or addresses). For this, cookies with the prefix "_swag_ga" (stored for up to 2 years) are set and usage data such as pages viewed, approximate location and device and browser information are transmitted to Google; Google Analytics 4 does not store IP addresses. Without consent, Google Analytics is not loaded; we do not use Google advertising features. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We have concluded a data processing agreement with Google. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. The data are deleted after 14 months. You can withdraw your consent at any time in the cookie settings in the footer. More information: policies.google.com/privacy.
6. Reviews and newsletters
When you submit a product review, we process its content, rating, name or chosen display details and the account data needed to associate it with you. Approved review text and display details are published; your email address is not displayed as part of the review (Article 6(1)(f) GDPR; interest in traceable product reviews). Published older shop reviews originate from the former Smarald shop. Marketplace excerpts identify their source and use publicly available reviews, without creating a new marketplace account. Please do not include other people’s personal information in reviews. Newsletter subscriptions involve processing your email and subscription evidence with consent (Article 6(1)(a) GDPR). A confirmation link verifies registration. You may unsubscribe at any time through the unsubscribe link or by email.
E-mail reminders
If you give your consent at checkout or in your customer account, we send you e-mail reminders: about a cart you did not order while logged in (once, at the earliest a few hours later), a request to review purchased items after shipping, and a notice when a filter change is due according to the interval we recommend. For this we process your e-mail address, your name, the contents of the cart (items and quantities) or the order data, and the time and source of your consent, and we log each e-mail sent. The legal basis is your consent (Art. 6(1)(a) GDPR; Section 7(2) no. 2 of the German Unfair Competition Act, UWG). You can withdraw your consent at any time with effect for the future – via the link “Stop receiving reminders” in every e-mail, in your customer account or by e-mail to kontakt@smarald.com. The saved cart is deleted after an order, when the cart is emptied, when you withdraw consent and at the latest after 30 days; the send log is deleted after two years. We send the e-mails via our mailbox at Host Europe and do not use tracking pixels or click tracking.
7. International transfers
Payment and video providers in particular may process data outside the EEA, including the USA. Depending on the recipient, safeguards include adequacy decisions under Article 45 GDPR or Article 46 guarantees, particularly standard contractual clauses and PayPal’s binding corporate rules. The EU–US Data Privacy Framework adequacy decision may apply to a certified US recipient; it does not cover every US company. Provider notices linked below explain details and how to obtain copies of safeguards; you may also contact us. If you request delivery to a third country, recipient information necessary to perform that contract is transferred to carriers there (Article 49(1)(b) GDPR where necessary).
8. Retention
We delete data when its purpose ends unless a retention duty or another lawful reason applies. Account data is needed to maintain the account; you may request deletion. Contractual and business correspondence is generally retained for six years, accounting vouchers for eight years, and books and annual accounts for ten years (section 147 AO, section 257 HGB), under the statutory calculation rules. Not every customer record is automatically subject to ten-year retention. Outstanding claims, audits or proceedings may require longer preservation. Consent records are retained as long as needed for evidence; advertising use ends upon withdrawal. Backups are overwritten in the regular backup cycle and are not used for new advertising purposes.
9. Your rights
Subject to statutory conditions, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and portability (20). You may withdraw consent at any time for the future without affecting the lawfulness of earlier processing. Where we rely on Article 6(1)(f), you may object for reasons relating to your particular situation (Article 21). You can object to direct marketing at any time without giving reasons. We do not ourselves make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR. Payment providers explain their own decisions in their notices. You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred (Article 77). In Saxony: Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, www.datenschutz.sachsen.de.
In-house shop statistics
With your consent, we count visits for internal shop statistics. The “smarald-statistics” cookie keeps your choice for 30 days; “smarald-visit-day” prevents repeated counts on the same day and expires no later than the next day. The statistics database stores only daily visit totals, without IP addresses or individual identifiers. Earlier Gambio data was imported solely as daily totals. You can withdraw consent in cookie settings at any time; no further visits are counted after withdrawal.