Data protection - GDPR

Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Dunasan GmbH
Pfaffendorfstr. 5c
83454 Anger
Germany
Phone: +49 8656 9895138
Email: office@dunasan.com
Customer Service: service@sanfino.de

Personal data means any information that can be used to personally identify you.

2. Hosting and Shopify

Our online shop is operated via the Shopify e-commerce platform. The provider of the Shopify services used for our shop is the Shopify entity responsible in accordance with the applicable Shopify contractual terms.

Where Shopify processes personal data of our customers on our behalf, Dunasan GmbH acts as the controller within the meaning of the GDPR and Shopify acts as the processor. Processing is carried out on the basis of the contractual relationship with Shopify and the Shopify Data Processing Addendum.

Shopify processes in particular technical data, order and transaction data, contact and delivery data, as well as other data required to provide and secure the online shop and to process orders.

Where Shopify provides certain services under its own responsibility, in particular so-called Enhanced Services, Shopify may itself act as the controller for the relevant processing. Information about such processing can be found in Shopify’s Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers.

Where Shopify Network Intelligence or Enhanced Services are enabled for our shop, data about your interactions and transactions with our shop may also be used by Shopify to provide personalised features, better understand the use of shops and advertising, and provide more relevant content or advertising. Depending on your location, you may manage or object to certain processing activities by Shopify at https://privacy.shopify.com.

Further information about Shopify can be found at https://www.shopify.com/legal/privacy.

3. Access Data and Server Log Files

When you access our website, technically necessary access data is processed. This may include, in particular, your IP address, date and time of access, pages or files accessed, browser type, operating system, referrer URL, amount of data transferred and the requesting provider.

Processing is carried out for the technical provision of the website, to ensure system security, for error analysis and to prevent misuse and attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure and uninterrupted operation of our online shop.

The data is deleted or anonymised as soon as it is no longer required for the stated purposes, unless statutory retention obligations require otherwise.

4. Data Processing for Orders and Contract Performance

If you place an order through our online shop, we process the data required to perform the contract. This includes, in particular, your name, billing and delivery address, email address, telephone number, ordered items, order and payment information, as well as any other information required to perform the contract.

The legal basis for this processing is Art. 6(1)(b) GDPR.

Mandatory fields are marked accordingly. Without the required information, we may not be able to process or fulfil your order.

Once the contract has been fully performed, further processing of the data will be restricted and the data will be deleted after the expiry of statutory commercial and tax retention periods, unless another legal basis permits longer storage or you have consented to further use.

5. Customer Account

Where we offer the option to create a customer account and you use such an account, we process the data you provide in order to provide and manage your customer account and to facilitate future orders.

Processing is carried out on the basis of Art. 6(1)(b) GDPR. You may request deletion of your customer account at any time, provided that no statutory retention obligations prevent deletion.

6. Contacting Us

If you contact us by email, contact form, telephone or another communication channel, we process the data you provide in order to handle your enquiry.

If your enquiry relates to a contract or steps prior to entering into a contract, processing is carried out on the basis of Art. 6(1)(b) GDPR. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in efficiently handling customer and prospective customer enquiries.

Data provided in the course of contacting us will be deleted once the relevant matter has been concluded and there are no statutory retention obligations or legitimate grounds for further storage.

7. Shipping and Delivery

For the purpose of fulfilling the purchase contract, we disclose the personal data required for delivery to the relevant shipping, logistics and freight service providers commissioned with delivery, storage or shipping fulfilment. The legal basis is Art. 6(1)(b) GDPR.

This may include, in particular, your name, delivery address, order information and, where required for the specific delivery, your telephone number and email address.

For freight and oversized parcel deliveries, prior scheduling of a delivery appointment is generally required. Where transmitting your telephone number or other contact details to the transport service provider is necessary to carry out and coordinate the contractually agreed delivery, such transmission is also carried out on the basis of Art. 6(1)(b) GDPR. Separate consent is not required for processing that is necessary for performance of the contract.

Depending on the shipping method, our shipping and logistics partners may include DHL as well