Privacy Policy
§ 1 General
We process personal data (e.g. salutation, name, address, email address, phone number, bank details, credit card number) exclusively in accordance with German data protection law and the GDPR. In this privacy policy, we inform you about the purposes, recipients, legal bases, storage periods, and your rights as a data subject.
This policy applies to our websites only. If you are redirected to external sites via links, please refer to their respective privacy policies for information on how your data is handled there.
§ 2 Data Processing for Contract Performance
(1) Purpose of Processing
The data you provide during the ordering process is required to enter into a contract with you and process your order. Without an address, we cannot ship the goods to you. For certain payment methods, we require payment data in order to pass it on to the payment service providers we engage.
If you contact us before entering into a contract (e.g. by email or via a form), we process this data to carry out pre-contractual measures and respond to your enquiry.
When you open a customer account, we process in particular your name, address, payment method, email, and password in order to create your account. This allows you to shop more quickly and view your orders at any time. Your account can be deleted at any time by sending us a message or using a deletion function.
(2) Legal Basis
Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
(3) Recipients
Payment service providers, shipping service providers, hosting providers, warehouse management systems where applicable, suppliers where applicable (dropshipping). In the event of complaints relating to XKAH brand products, additional data is transmitted to the manufacturer XKAH; details can be found in § 4.
(4) Storage Period
We store contract-related data until the expiry of statutory warranty periods and, where applicable, contractual guarantee periods. Data subject to commercial and tax law obligations is generally retained for ten years in accordance with statutory requirements (§ 257 HGB, § 147 AO). Data from pre-contractual enquiries is deleted once the enquiry has been concluded and no contract has been entered into.
§ 3 Comments
(1) Purpose of Processing
When you post a comment, we use the information you provide (e.g. name/pseudonym, email address, website) solely for the purpose of publishing the comment.
(2) Legal Basis
Art. 6(1)(f) GDPR (legitimate interest).
(3) Legitimate Interest
Our interest lies in the public exchange of user opinions on topics and products. You may post comments under a pseudonym.
(4) Storage Period
No fixed storage period is defined. You may request the deletion of your comment at any time.
(5) Right to Object
You may object to processing based on Art. 6(1)(f) GDPR at any time where there are grounds arising from your particular situation. In the case of direct marketing, you may object at any time without giving reasons.
§ 4 Complaints and Warranty for XKAH Products
(1) Purpose of Processing
Complaints and warranty enquiries relating to XKAH brand products are handled centrally via a dedicated form on the subdomain xkah.mozeshisha.de. This applies to our own customers as well as customers of other retailers who purchased XKAH products through us and have been referred to our complaints form by their retailer.
When you submit such a complaint, we process the data you provide in order to review, handle, and communicate about your concern, and to process warranty and guarantee claims.
(2) Categories of Data Collected
In the context of complaints handling, we process first and last name, email address, phone number (optional), purchase details (date of purchase, order/invoice number, retailer), description of the defect, photos or videos of the defect where applicable, shipping/address details where required to process an exchange, and the communication history relating to the complaint.
(3) Legal Basis
For complaints arising from a purchase contract with Moze GmbH: Art. 6(1)(b) GDPR (performance of a contract). For complaints submitted to us by customers of other retailers, and for the transfer to XKAH: Art. 6(1)(f) GDPR (legitimate interest in uniform complaints handling and in asserting manufacturer warranty claims).
(4) Recipients and Third-Country Transfers
In the context of complaints handling, we transfer your data to the manufacturer XKAH. XKAH is an independent controller within the meaning of Art. 4(7) GDPR and uses the data for its own purposes (warranty processing, handling of guarantee claims, quality assurance).
XKAH is based outside the European Union (in particular Hong Kong and the United States of America). No adequacy decision by the European Commission exists for these third countries. The transfer therefore takes place on the basis of standard contractual clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. Prior to commencing the transfer, we conducted a Transfer Impact Assessment to verify that a substantially equivalent level of data protection is ensured.
Notwithstanding these safeguards, access to your data by public authorities in the aforementioned third countries cannot be ruled out in every case. Enforcing your data subject rights against XKAH may involve additional effort.
A copy of the standard contractual clauses can be requested using the contact details provided in the legal notice.
In addition, your data is shared with our hosting provider, shipping service providers where applicable (e.g. DHL), and our warehouse management system where applicable, each acting as data processors.
(5) Storage Period
We store the data you submit in connection with a complaint for as long as necessary to handle your concern and to preserve any warranty or guarantee claims. Statutory retention obligations (in particular § 257 HGB, § 147 AO) remain unaffected. We have no influence over the independent storage period applied by XKAH.
(6) Right to Object
Where we process your data on the basis of Art. 6(1)(f) GDPR, in particular for the transfer to XKAH, you may object to such processing at any time on grounds relating to your particular situation (see § 7). In such cases, it may no longer be possible to fully process your complaint.
(7) Further Information
Detailed information on data processing in connection with the complaints form can be found in the privacy policy of the subdomain at xkah.mozeshisha.de/datenschutz.
§ 5 PayPal Transactions
All PayPal transactions are subject to the PayPal privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full.
§ 6 Credit Assessment by Klarna
When using Klarna, the privacy policy of Klarna Bank AB applies: Klarna Privacy Policy.
§ 7 Information About Cookies
(1) Purpose of Processing
We use technically necessary cookies. These are not stored permanently and enable functions such as the shopping cart. Additional cookies may be stored permanently to provide convenience features, such as saving login details.
(2) Legal Basis
Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website). Non-essential cookies are only used with your consent pursuant to Art. 6(1)(a) GDPR.
(3) Storage Period
Necessary cookies are generally deleted when the browser is closed. Persistent cookies have a lifespan ranging from a few minutes to several years.
(4) Withdrawal
You can delete or disable cookies at any time via your browser settings. Please note that this may limit the functionality of the website.
§ 8 Newsletter
(1) Purpose of Processing
When you sign up for the newsletter, we use your email address to inform you about products and offers. For statistical purposes, we analyse which links are clicked, without drawing conclusions about individual users.
(2) Legal Basis
Art. 6(1)(a) GDPR (consent).
(3) Recipients
Newsletter delivery providers, where applicable.
(4) Storage Period
We store your email address only for as long as you remain subscribed to the newsletter.
(5) Withdrawal
You may withdraw your consent at any time, for example via the unsubscribe link in the newsletter.
(6) Advertising to Existing Customers
If we have received your email address in connection with a purchase and you have not objected, we may send you offers for similar products on the basis of § 7(3) UWG. You may object to this at any time at no cost beyond the basic transmission rates. Following unsubscription, we will remove your email address from the recipient list, unless another legal basis applies.
§ 9 Your Rights
As a data subject, you have the following rights:
- Access to your processed data (Art. 15 GDPR).
- Rectification of inaccurate or incomplete data (Art. 16 GDPR).
- Erasure of your data, where the relevant conditions are met (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR).
- Lodging a complaint with a supervisory authority (Art. 77 GDPR).
Right to Object under Art. 21 GDPR
Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR) or in the public interest (Art. 6(1)(e) GDPR), you may object at any time on grounds relating to your particular situation.
Where data is processed for direct marketing purposes, you may object at any time without giving reasons. Following your objection, we will no longer process the relevant data for those purposes.
Controller
Moze GmbH
An der Haarbrücke 6
49716 Meppen
Germany
Phone:01781883338
Email:info[at]mozeshisha.de
For more information about our products, visit the Shisha Tobacco, Shisha, Vapes, Shisha Charcoal, and Shisha Accessories sections.