PRIVACY POLICY

1. Information about the collection of personal data and contact details of the data controller

1.1 We're glad you're visiting our website and thank you for your interest. Below, we explain how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.

1.2 The data controller for this website is Ivy & Rose Byron. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3 This website uses SSL/TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the data controller). You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser's address bar.

2. Data collection when visiting our website

When you use our website purely for informational purposes — that is, if you do not register or provide us with information in any other way — we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary to display the website to you:

The website visited
Date and time of access
Amount of data sent in bytes
Source/referrer from which you accessed this page
Browser used
Operating system used
IP address used (possibly anonymised)

This processing is carried out in accordance with Article 6(1)(f) GDPR, based on our legitimate interest in improving the stability and functionality of our website. The data will not be shared or used for any other purpose. However, we reserve the right to subsequently review server log files if there are concrete indications of unlawful use.

3. Cookies

To make your visit to our website more enjoyable and to enable certain features, we use so-called cookies on various pages. These are small text files stored on your device. Some of the cookies we use are deleted after your browsing session ends, i.e. after closing your browser (session cookies). Other cookies remain on your device and allow us, or our partner companies (third-party cookies), to recognise your browser on your next visit (persistent cookies).

When cookies are set, certain user information such as browser and location data, as well as IP addresses, is collected and processed at different levels. Persistent cookies are automatically deleted after a predetermined period, which may vary depending on the cookie.

In some cases, cookies are used to simplify the shopping process by saving settings (for example, remembering the contents of a virtual shopping cart for a later visit to the site). If any of the cookies we use also process personal data, this processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of a contract, or Article 6(1)(f) GDPR to protect our legitimate interests in ensuring the best possible website functionality and a user-friendly, effective experience.

We may work with advertising partners who help us make our website more interesting to you. For this purpose, cookies from partner companies (third-party cookies) may also be stored on your hard drive when you visit our website.

Note: You can set your browser to notify you when cookies are being installed and decide individually whether to accept them, block them in certain cases, or block them entirely. Each browser manages cookie settings differently. Please note that if you do not accept cookies, the functionality of our website may be limited.

Browser cookie settings:

Internet Explorer: support.microsoft.com/help/17442
Firefox: support.mozilla.org/kb/cookies-allow-and-reject
Chrome: support.google.com/chrome/answer/95647
Safari: support.apple.com/kb/ph21411
Opera: help.opera.com/en/latest/web-preferences/#cookies

4. Contact

When you contact us (for example, via the contact form or email), we collect personal data. The specific data collected via the contact form is indicated on the form itself. This data is stored and used exclusively to respond to your enquiry, to contact you, and for related technical administration.

The legal basis for processing your data is our legitimate interest in responding to your enquiry, in accordance with Article 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted once your enquiry has been fully processed, unless legal retention obligations apply.

5. Data processing when opening a customer account and processing a contract

In accordance with Article 6(1)(b) GDPR, personal data will continue to be collected and processed if you provide it for the performance of a contract or when opening a customer account. The specific data collected is evident from the respective data entry forms.

You may delete your customer account at any time by sending a message to the data controller's address listed above. We store and use the data you provide for contract processing. After the contract is completed or your customer account is deleted, your data will be blocked in accordance with retention periods required by tax and commercial law, and deleted once those periods expire, unless you have expressly consented to further use of your data.

6. Use of your data for direct marketing

6.1 — Newsletter sign-up

By signing up for our email newsletter, you will receive regular updates about our offers. The only information required to send you the newsletter is your email address. We use a double opt-in process for newsletter sign-ups. This means we will only send the newsletter by email after you have explicitly confirmed that you agree to receive it.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) GDPR. When you sign up for the newsletter, we store your IP address as provided by your internet service provider (ISP), as well as the date and time of registration. You may unsubscribe from the newsletter at any time via the link provided in the newsletter itself. Once unsubscribed, your email address will be immediately removed from our newsletter distribution list.

6.2 — Sending newsletters to existing customers

If you have provided us with your email address when purchasing products or services, we reserve the right to regularly send you offers for similar products or services from our range by email. Your specific consent is not required for this. Data processing is based solely on our legitimate interest in personalised direct marketing, in accordance with Article 6(1)(f) GDPR. You have the right to object to the use of your email address for advertising purposes at any time, with effect for the future.

7. Data processing for contract fulfilment

7.1 The personal data we collect will be shared with the shipping carrier responsible for delivery, as part of contract processing, to the extent necessary for the delivery of goods. We will also share your payment data with the bank responsible for processing payment, to the extent necessary for that purpose. The legal basis for this data transfer is Article 6(1)(b) GDPR.

7.2 — Payment service providers

PayPal: When paying via PayPal, credit card via PayPal, direct debit via PayPal, or — if offered — "buy now, pay later" or instalment payment via PayPal, we forward your payment data to PayPal (Europe) S.à.r.l. et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg. This transfer is carried out in accordance with Article 6(1)(b) GDPR and only to the extent necessary for payment processing. PayPal reserves the right to carry out a credit check. You may object to this processing at any time by sending a message to PayPal.

8. Review reminder

We will use your email address to send you a one-time reminder asking you to review your order in our rating system, provided you have expressly consented to this during or after placing your order, in accordance with Article 6(1)(a) GDPR. You may withdraw your consent at any time by contacting the data controller.

9. Use of social media: Social plugins

9.1 — Facebook plugins (Shariff solution)

Our website uses social plugins from the social network Facebook, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. To increase your data protection when visiting our website, these buttons are not integrated as full plugins, but rather via an HTML link. This ensures that no connection to Facebook's servers is established when you access a page on our website that contains these buttons. Only when you click the button will a new browser window open, directing you to the Facebook page, where you can interact with the plugins.

9.2 — Instagram plugin (Shariff solution)

Our website uses social plugins from the online service Instagram, operated by Instagram, LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA. The same Shariff HTML link solution applies here, meaning a connection to Instagram's servers is only established when the button is actively clicked.

10. Online marketing

10.1 — Google DoubleClick

This website uses Google's online marketing tool DoubleClick (Google LLC). DoubleClick uses cookies to display relevant ads to users, improve campaign performance reporting, or prevent a user from seeing the same ad multiple times. This processing is based on our legitimate interest in optimising our website's marketing, in accordance with Article 6(1)(f) GDPR. According to Google, DoubleClick cookies do not contain any personally identifiable information.

10.2 — Google Ads conversion tracking

This website uses the Google Ads online advertising program and its conversion tracking system. We use Google Ads to advertise our offers on external websites through advertising materials (so-called Google Ads ads). The conversion tracking cookie is set when a user clicks on a Google Ads ad served by Google. These cookies generally expire after 30 days and are not used for personal identification. This processing is based on our legitimate interest, in accordance with Article 6(1)(f) GDPR.

11. Web analytics services

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to analyse how users use the website. This website uses Google Analytics exclusively with IP anonymisation enabled, which shortens your IP address and prevents direct identification of individuals.

Google will use this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide other services related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

This website also uses Google Analytics to analyse visitor traffic across different devices, carried out via a User ID. A unique, persistent, anonymised ID is assigned upon first page view and stored across devices. The User ID does not contain personal data and does not transmit such data to Google. You may object to data collection and storage via the User ID at any time, with effect for the future.

12. Retargeting / Remarketing / Referral advertising

Facebook Custom Audiences (pixels)

This website uses the "Facebook Pixel" from Meta Platforms, Inc. With your explicit consent, user behaviour can be tracked after you view or click on a Facebook ad. This process is used to evaluate the effectiveness of Facebook ads for statistical and market research purposes. The data collected is anonymous to us. However, the data is stored and processed by Facebook. Processing occurs only with your explicit consent, in accordance with Article 6(1)(a) GDPR. Consent to the use of the Facebook Pixel may only be given by users over the age of 13.

Google Ads Remarketing

Our website uses the remarketing features of Google Ads. Google installs a cookie in your browser which, based on a pseudonymous cookie ID and the pages you visit, enables the display of ads based on your interests. This processing is based on our legitimate interest, in accordance with Article 6(1)(f) GDPR. Further data processing only occurs if you have consented to Google linking your web and app browsing history to your Google account.

13. Your rights as a data subject

13.1 Applicable data protection law grants you extensive rights (access and intervention rights) as a data subject with respect to the controller regarding the processing of your personal data:

Right of access: Right to information about the personal data we process, the purposes of processing, categories, recipients, planned retention period, and other information.
Right to rectification: Right to the immediate correction of inaccurate data and/or completion of incomplete data stored by us.
Right to erasure: Right to have your personal data deleted, provided the relevant conditions are met.
Right to restriction of processing: Right to restrict the processing of your personal data.
Right to notification: Right to information about all recipients to whom personal data has been disclosed.
Right to data portability: Right to receive your personal data in a structured, commonly used, machine-readable format.
Right to withdraw consent: Right to withdraw consent at any time, with effect for the future.
Right to lodge a complaint: Right to lodge a complaint with a supervisory authority.

13.2 — Right to object

Right to object: If we process your personal data based on our overriding legitimate interest, as part of a balancing of interests, you have the right to object to this processing at any time for reasons relating to your particular situation, with effect for the future. If you exercise your right to object, we will stop processing the data in question. However, we reserve the right to continue processing the data if we can demonstrate compelling legitimate grounds that override your interests, rights, and fundamental freedoms, or if processing is necessary for the establishment, exercise, or defence of legal claims.

Direct marketing: If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose. If you exercise this right, we will stop processing your data for direct marketing purposes.

14. Duration of storage of personal data

The storage period for personal data depends on the applicable statutory retention period (e.g. retention periods under commercial and tax law). After this period expires, the corresponding data is routinely deleted, unless it is still required for the performance or conclusion of a contract and/or we have a legitimate interest in its continued storage.