Privacy & Cookie Policy

We are pleased about your visit to our online shop. Protecting your personal data matters to us. Below we inform you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), about which data we process when you use zoevacosmetics.com, for which purposes, on which legal basis, and which rights you have. Section 4 of this policy also constitutes our cookie policy.

1. Controller

ZOEVA GmbH
Karl-Ritscher-Anlage 1-3
60437 Frankfurt am Main, Germany
E-mail: service@zoeva.de
Contact form

2. Data Protection Officer

Our external Data Protection Officer is:

Nils Gustke
GfP Gesellschaft für Personaldienstleistungen mbH
Pestalozzistraße 27, 34119 Kassel, Germany
Phone: +49 561 220774-30
E-mail: datenschutz@gfp24.de

3. Processing Activities

3.1 Visiting the Website (Hosting and Server Logs)

Our online shop is operated on the Shopify platform (Shopify International Ltd., 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland — acting as our processor). When you merely browse, we process the data your browser transmits for technical reasons: IP address, date and time of the request, page accessed, HTTP status code, data volume transferred, referrer URL, browser type and version, operating system, language setting.

Purpose: displaying the website, stability, security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: server logs are kept only for as long as required for these purposes — as a rule, a few weeks.

3.2 Customer Account

When you create an account we process: title, first and last name, address, e-mail address, phone number, language, password (encrypted), order history and preferred payment method.

Purpose: providing the account and order overview. Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete your account (request via service@zoeva.de or the contact form); statutory retention obligations remain unaffected (Section 8).

3.3 Orders and Purchase Processing

For an order (with an account or as a guest) we process: name, billing and delivery address, e-mail address, phone number (for delivery notifications), order and payment data.

Purpose: performance of the contract including delivery, invoicing, returns and warranty handling. Legal basis: Art. 6(1)(b) GDPR; for the retention of accounting records Art. 6(1)(c) GDPR in conjunction with Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB).

Payment providers: Depending on the payment method chosen, your payment data is processed directly by the respective provider acting on its own responsibility: Shopify Payments/Shop Pay (Shopify International Ltd., Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Klarna Bank AB (publ) (Sweden), Apple Pay (Apple Distribution International Ltd., Ireland), Google Pay (Google Ireland Ltd.). The respective provider's privacy policy applies in addition.

Shipping: For delivery we transfer your name, delivery address and — where required for delivery notifications — your e-mail address and phone number to the shipping and logistics providers used for the respective country of delivery (in particular DHL and our fulfilment partners). Legal basis: Art. 6(1)(b) GDPR.

3.4 Customer Service

We handle enquiries submitted via our contact form, e-mail or chat with our helpdesk system Gorgias Inc. (processor). We process your contact details, the content of the enquiry and, where relevant, order data.

Legal basis: Art. 6(1)(b) GDPR (contract-related enquiries) or Art. 6(1)(f) GDPR (general enquiries). Retention: we delete service records as soon as they are no longer required for handling and documentation; statutory retention obligations remain unaffected (Section 8).

3.5 Newsletter (Klaviyo) and Personalisation

We send our newsletter via Klaviyo Inc. (USA) only after sign-up using the double opt-in procedure: after registering you receive a confirmation e-mail and are only added to the list once you click the confirmation link. We log the time of registration and confirmation as well as the IP address (for evidence purposes).

To personalise the newsletter we analyse: opening and click behaviour, country/language, viewed products, order history (including order value, purchase frequency, basket profile, customer lifetime value). From this we create an interest profile to send you relevant content.

Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal: at any time via the unsubscribe link in every e-mail or to service@zoeva.de — the lawfulness of processing carried out before withdrawal remains unaffected. Retention: until withdrawal; afterwards your address is kept on a suppression list to permanently ensure the opt-out is honoured.

3.6 Back-in-Stock Notification

On request, we notify you by e-mail when a product is available again. We process your e-mail address. Legal basis: Art. 6(1)(a) GDPR (consent). The address is not used further for this purpose after the notification has been sent.

3.7 Product Reviews (Yotpo)

We collect reviews via Yotpo Ltd. After a purchase you receive an invitation to review; only customers who actually purchased the product from us can submit a review (verified purchases). We process your e-mail address, name/nickname (optional) and the review content.

Legal basis: review invitation after a purchase: Section 7(3) of the German Act against Unfair Competition (UWG) in conjunction with Art. 6(1)(f) GDPR (legitimate interest); you may object to receiving such invitations at any time (Section 9). Publication of the review: Art. 6(1)(a) GDPR (consent).

4. Cookies, Tracking and Online Marketing (Cookie Policy)

4.1 Legal Bases and Consent

We use cookies and similar technologies (pixels, local storage, SDKs). Storing information on your device and accessing it is governed by Section 25 of the German TDDDG; the subsequent processing of personal data by the GDPR:

• Strictly necessary technologies (e.g. basket, login, language/country selection, consent storage, fraud prevention): permitted without consent (Section 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR).
• All other technologies (statistics, personalisation, marketing): only with your consent (Section 25(1) TDDDG; Art. 6(1)(a) GDPR).

On your first visit, our consent banner (provider: Pandectes GDPR Compliance) asks for your choice. Without consent, no non-essential technologies are loaded. We store your choice (including a refusal) in a cookie (_pandectes_gdpr) so that we do not have to ask you again.

4.2 Changing or Withdrawing your Choice

You can change or withdraw your consent at any time with effect for the future: click "Cookie Banner" in the footer — there you can enable or disable categories individually. Independently of this, you can delete or block cookies in your browser settings.

4.3 Categories and Services Used

The retention periods stated are maximums according to the providers' documentation; the current status, which we review regularly, is decisive.

a) Strictly Necessary (no consent required)

Service	Provider	Purpose	Retention
Shopify shop functions (_shopify_y, _shopify_s, cart, localization etc.)	Shopify International Ltd. (IE)	Basket, session, country/language selection, security	Session up to 1 year
Pandectes consent (_pandectes_gdpr)	Pandectes	Storage of your cookie choice	1 year

b) Statistics / Analytics (consent only)

Service	Provider	Purpose	Retention
Google Analytics 4 (_ga, _ga_*)	Google Ireland Ltd.	Reach and usage analysis	up to 2 years
Microsoft Clarity (_clck, _clsk)	Microsoft Ireland Operations Ltd.	Usage analysis, heatmaps, session replay (input fields masked)	1 day to 1 year
Shoplift (Shoplift_*)	Shoplift Inc.	A/B testing of the shop design	up to 1 year

c) Personalisation / Functional (consent only)

Service	Provider	Purpose	Retention
Rebuy (_rsession, _ruid)	Rebuy Engine LLC	Personalised product recommendations	Session up to 1 year
Yotpo (yotpo_pixel)	Yotpo Ltd.	Displaying and collecting product reviews	up to 1 year

d) Marketing (consent only)

Service	Provider	Purpose	Retention
Meta Pixel (_fbp)	Meta Platforms Ireland Ltd.	Interest-based advertising, conversion measurement (Facebook/Instagram)	3 months
TikTok Pixel (_ttp, ttcsid)	TikTok Technology Ltd. (IE)	Interest-based advertising, conversion measurement	up to 13 months
Google Ads / Conversion (_gcl_au)	Google Ireland Ltd.	Conversion measurement, remarketing	3 months
Microsoft Advertising / Bing UET (_uetsid, _uetvid)	Microsoft Ireland Operations Ltd.	Conversion measurement, remarketing	1 day to 13 months
Klaviyo onsite (__kla_id)	Klaviyo Inc.	Linking shop behaviour to the newsletter profile	up to 2 years

5. Recipients

We only share data where necessary for contract performance, where you have consented, or where a legal basis exists. Categories of recipients: shop platform (Shopify International Ltd., Ireland / Shopify Inc., Canada), payment and shipping providers (Section 3.3), helpdesk (Gorgias), e-mail marketing (Klaviyo), reviews (Yotpo), marketing and analytics services (Section 4), IT and agency service providers, tax advisors/auditors, and authorities where legally required. Processors are bound by contracts pursuant to Art. 28 GDPR.

6. Transfers to Third Countries

Some recipients are located outside the European Economic Area or process data there (in particular the USA). Transfers are based on:

• Adequacy decisions of the EU Commission — for the USA the EU-U.S. Data Privacy Framework (DPF), where the recipient is certified (including Google LLC, Meta Platforms Inc., Microsoft Corp., Klaviyo Inc.); for Canada (Shopify Inc.) the adequacy decision for commercial organisations;
• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures where no DPF certification exists.

You can request a copy of the respective safeguards via the contact details in Section 1.

7. Note for Customers outside the EU

For visitors from Switzerland, the provisions of the revised Swiss Data Protection Act (DSG) additionally apply; the controller and your rights correspond to this policy.

8. Retention Periods

We store personal data only for as long as necessary for the stated purposes and delete it afterwards. Contract and accounting data is subject to statutory commercial and tax retention obligations and is stored in restricted form for their duration: commercial books and annual financial statements 10 years, accounting records 8 years, commercial and business letters 6 years (Sections 238, 257 HGB, Section 147 AO). Consent-based data is stored until withdrawal; we retain evidence of given consents for the defence of legal claims (Art. 17(3)(e) GDPR).

9. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future, e.g. via the "Cookie Banner" footer link, the unsubscribe link in the newsletter, or informally to service@zoeva.de

Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons; this also applies to profiling to the extent that it is related to such direct marketing. Send your objection informally to service@zoeva.de.

To exercise your rights, an informal message to the contact details in Section 1 or to our Data Protection Officer (Section 2) is sufficient.

Right to lodge a complaint: You have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de.

10. Obligation to Provide Data

You are neither legally nor contractually obliged to provide your data. However, without the data required for ordering and delivery (Section 3.3) we cannot fulfil your order. All other information is voluntary.

11. Automated Decision-Making

We do not carry out automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you. If you choose a deferred payment method with Klarna (e.g. pay by invoice), Klarna, acting on its own responsibility, may carry out its own credit assessment; Klarna's privacy policy applies in that respect. Newsletter personalisation (Section 3.5) involves profiling for advertising purposes based on your consent.

12. Changes to this Privacy Policy

We amend this policy when our processing activities or the legal situation change. The current version is available on this page; the version date is shown at the end of this page.

Last updated: August 2026