Privacy Policy /
Data Protection Declaration

Privacy Policy / Data Protection Declaration

Last updated: September 2026

1. General information

We take the protection of your personal data seriously. This Privacy Policy explains how we collect, use and protect personal data when you visit our website, use our online shop, contact us or purchase products from us.

The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

2. Controller

The controller responsible for data processing on this website is:

mvdham GmbH
Weisestr. 31
12049 Berlin
Germany

Email: mail@mvdham.com

If you have any questions regarding the processing of your personal data, please contact us at the email address above.

3. Personal data

Personal data means any information relating to an identified or identifiable individual. This may include, for example, your name, postal address, email address, telephone number, payment information, IP address or information concerning your orders.

We only process personal data where there is a legal basis for doing so.

4. Visiting our website

When you visit our website, certain information is automatically transmitted to our server by your browser. This may include:

  • IP address

  • date and time of access

  • requested page or file

  • browser type and version

  • operating system

  • referring website

  • technical information required to deliver and secure the website

This information is processed to provide the website, ensure its technical security and stability, detect and prevent misuse, and to improve the technical operation of our website.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

Where technically necessary, information may also be stored in cookies or similar technologies. Further information can be found in the section “Cookies and similar technologies”.

5. Hosting

Our website and online shop are hosted by an external service provider.

As part of hosting, the provider may process personal data transmitted through your use of our website, including technical connection data and server log information.

The processing is carried out for the purpose of providing a secure and functional website and online shop.

Where required by applicable data protection law, we have concluded an appropriate data processing agreement with the relevant service provider.

6. Online shop and orders

When you place an order through our online shop, we process the personal data necessary to process and fulfil your order.

Depending on the order, this may include:

  • first and last name

  • billing and delivery address

  • email address

  • telephone number, where provided or required

  • information concerning the products ordered

  • order and transaction information

  • payment-related information

We process this information in order to:

  • process and fulfil your order;

  • arrange delivery;

  • process payments;

  • communicate with you regarding your order;

  • handle returns, refunds and warranty matters;

  • comply with our legal and accounting obligations.

The legal basis for this processing is Art. 6(1)(b) GDPR, where the processing is necessary for the performance of a contract or for taking steps at your request prior to entering into a contract.

Where processing is required to comply with a legal obligation, the legal basis is Art. 6(1)(c) GDPR.

7. Customer accounts

If our online shop allows you to create a customer account, we process the information you provide in order to create and manage your account and provide the associated services.

The legal basis is Art. 6(1)(b) GDPR.

You can request the deletion of your customer account at any time, unless statutory retention obligations or other legitimate reasons prevent immediate deletion.

8. Payment processing

Depending on the payment method selected during checkout, payment information may be processed by external payment service providers.

The relevant payment provider may process personal data such as your name, billing information, payment information, transaction details and other information required to process or verify the payment.

Payment processing is carried out to fulfil the contract with you pursuant to Art. 6(1)(b) GDPR and, where applicable, to comply with legal obligations pursuant to Art. 6(1)(c) GDPR.

The payment provider’s own privacy policy may apply to the processing carried out by that provider.

9. Shipping and delivery

In order to deliver your order, we provide the shipping service provider with the information required for delivery.

Depending on the delivery method, this may include your name, delivery address, email address and/or telephone number.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary for the fulfilment of the contract.

10. Communication and contact

If you contact us by email, contact form, telephone or other means, we process the information you provide in order to respond to your enquiry.

Depending on the nature of your enquiry, this may include your name, contact details and the contents of your communication.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures. In other cases, processing is based on Art. 6(1)(f) GDPR or another applicable legal basis.

We retain correspondence only for as long as necessary to handle your enquiry and, where applicable, for the duration required by statutory retention obligations.

11. Newsletter

If you subscribe to our newsletter, we process your email address and any other information required for sending the newsletter.

Newsletter registration is based on your consent pursuant to Art. 6(1)(a) GDPR.

We use a double opt-in procedure where applicable. After registering, you will receive a confirmation email asking you to confirm your subscription. Your subscription will only become active after confirmation.

You can withdraw your consent at any time by using the unsubscribe link contained in each newsletter. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

After unsubscribing, your email address may be retained in a suppression list where necessary to ensure that you are not inadvertently sent further newsletters.

12. Cookies and similar technologies

Our website uses cookies and similar technologies.

Cookies are small files stored on your device that enable certain functions of the website or help us understand how the website is used.

Some cookies are technically necessary for the operation, security and functionality of the website and online shop. These cookies may be used without consent where permitted by applicable law.

Other cookies, for example those used for analytics, advertising or similar purposes, are only used where the required consent has been obtained.

Where consent is required, you can give or refuse your consent through our cookie consent mechanism. You can also change or withdraw your consent at any time through the available cookie settings.

The legal basis for technically necessary processing is generally Art. 6(1)(f) GDPR and, where applicable, the relevant provisions of German telecommunications and data protection law.

Where processing is based on consent, the legal basis is Art. 6(1)(a) GDPR.

13. Analytics and statistics

We may use analytics technologies to understand how visitors use our website and to improve its content, functionality and performance.

Where such technologies process personal data or access information stored on your device and consent is legally required, they will only be activated after you have given the required consent.

The specific analytics services used on the website may change as part of our ongoing website development. The applicable services and settings should therefore be reviewed and updated in this Privacy Policy whenever the technical configuration of the website changes.

14. Social media

We maintain a presence on social media platforms, including Instagram and Facebook.

If you visit our social media profiles, the respective social media provider may process personal data in accordance with its own privacy policy.

We may also include links to our social media profiles on our website. Merely visiting our website does not necessarily result in personal data being transmitted to the respective social media provider through such links.

If social media content, plugins or other integrated functions are used on our website, additional data processing may take place. Such integrations should only be activated where the applicable legal requirements are met.

15. Data recipients

We may disclose personal data to third parties where this is necessary for the purposes described in this Privacy Policy.

These recipients may include, depending on the services actually used:

  • hosting and IT service providers;

  • payment service providers;

  • shipping and logistics providers;

  • newsletter service providers;

  • service providers supporting our online shop;

  • accounting and tax service providers;

  • legal or professional advisers;

  • public authorities where legally required.

We only disclose personal data where there is an appropriate legal basis for doing so.

Where service providers process personal data on our behalf, we enter into appropriate data processing agreements where required by law.

16. Transfers to countries outside the European Economic Area

Some service providers may process personal data in countries outside the European Economic Area (EEA).

Where personal data is transferred to a country for which the European Commission has not recognised an adequate level of data protection, we ensure that an appropriate transfer mechanism is in place, such as Standard Contractual Clauses approved by the European Commission, where applicable.

Where required, additional safeguards are implemented.

17. Storage and retention periods

We retain personal data only for as long as necessary for the respective processing purpose.

In addition, we may be required to retain certain information for longer periods due to statutory retention obligations, particularly under commercial, tax and accounting law.

Once the relevant purpose has expired and no further legal obligation or legitimate reason for retention exists, the data will be deleted or anonymised.

18. Your rights

Subject to the legal requirements, you have the following rights under the GDPR:

Right of access

You have the right to request information about whether we process personal data relating to you and, if so, to obtain access to that data and further information pursuant to Art. 15 GDPR.

Right to rectification

You have the right to request the correction of inaccurate personal data and completion of incomplete personal data pursuant to Art. 16 GDPR.

Right to erasure

You may request the deletion of your personal data under the conditions of Art. 17 GDPR.

Right to restriction of processing

Under certain circumstances, you may request restriction of the processing of your personal data pursuant to Art. 18 GDPR.

Right to data portability

Where the legal requirements are met, you have the right to receive personal data concerning you in a structured, commonly used and machine-readable format or request its transmission to another controller pursuant to Art. 20 GDPR.

Right to object

Where we process your personal data on the basis of Art. 6(1)(e) or Art. 6(1)(f) GDPR, you may object to such processing for reasons arising from your particular situation.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

Withdrawal of consent

Where processing is based on your consent, you may withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact us using the contact details provided above.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

You may contact the supervisory authority responsible for our registered office or another competent supervisory authority.

The competent supervisory authority for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Friedrichstr. 219
10969 Berlin
Germany

20. Data security

We use appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

We regularly review and adapt our security measures to take account of technological developments and changes to our services.

21. Children

Our online shop is not directed at children under the age of 18. According to our Terms and Conditions, we do not accept orders from customers under 18 years of age.

We do not knowingly collect personal data from children for purposes that are not permitted by law.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, online shop, services, legal requirements or data processing activities.

The current version will always be published on this page. The date of the latest update is stated at the beginning of this Privacy Policy.

mvdham GmbH
Weisestr. 31
12049 Berlin
Germany

Email: mail@mvdham.com