Privacy policy

Last updated: October 2026

This is a translation of the German privacy policy for your convenience. In case of doubt, the German version applies.

1. Controller

The controller within the meaning of the GDPR is:
Lubow Otto
Luba Moden (sole proprietorship)
Riehlstr. 11
14057 Berlin
Germany
Tel.: +49 (0) 30 30 20 26 37
E-mail: info@lubamoden.de

2. General information on data processing

As a matter of principle, we process personal data only to the extent necessary to provide a functional website as well as our content and services. Processing takes place with the consent of the data subject or on the basis of a statutory permission.

The legal bases are in particular:
– Art. 6(1)(a) GDPR – consent
– Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures
– Art. 6(1)(c) GDPR – compliance with a legal obligation
– Art. 6(1)(f) GDPR – legitimate interest

Personal data are erased or blocked as soon as the purpose of storage ceases to apply or a statutory retention period expires.

3. Hosting and provision of the website (Shopify)

Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

When you visit our shop, Shopify processes on our behalf the technically necessary access data (in particular IP address, date and time of access, browser type and version, operating system, referrer URL, pages accessed) in server log files. The legal basis is Art. 6(1)(f) GDPR or, for order processing, Art. 6(1)(b) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with Shopify.

4. Cookies and consent management

Our website uses cookies and similar technologies. Technically necessary cookies (e.g. shopping cart, login, language setting) are required for operation; the legal basis is Art. 6(1)(f) GDPR or Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act).

For all non-essential cookies and technologies (in particular analytics and marketing), we obtain your consent via the cookie banner integrated in Shopify (consent management) (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). These services are only activated after you have given your consent. You can change or withdraw your selection at any time with effect for the future via the cookie settings.

5. Orders and customer account

To process your order, we process the data you provide (in particular name, billing and delivery address, e-mail address, telephone number where applicable, as well as order and payment data). Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR and to comply with retention obligations under tax and commercial law pursuant to Art. 6(1)(c) GDPR.

You may optionally create a customer account. We store the data provided in this process until the account is deleted.

6. Payment processing (Shopify Payments, PayPal)

Payments are processed via Shopify Payments (Shopify International Limited, Ireland). The data required for payment processing (including name, payment and billing data) are processed as part of the payment process and transmitted to the payment processors involved. If you choose a payment method such as Klarna, Apple Pay or Google Pay, the respective provider also receives the data required for the payment. The legal basis is Art. 6(1)(b) GDPR. The transmission is encrypted.

If you pay with PayPal, we transmit the data required for the payment (including name, address, e-mail address, order amount) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The legal basis is Art. 6(1)(b) GDPR. On product pages, our shop also embeds elements from PayPal (for example payment buttons or payment notices); in doing so, your IP address is transmitted to PayPal. The legal basis is our legitimate interest in a fast payment process (Art. 6(1)(f) GDPR). Further information: https://www.paypal.com/de/legalhub/privacy-full

7. Shipping and order processing

To deliver the goods, we pass on your shipping data (name, delivery address, e-mail/telephone for shipment tracking where applicable) to the shipping service provider DPD (DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg). The technical connection is made via the Shopify app easyDPD.

For internal order and shipping management, we also use Billbee (Billbee GmbH, Germany), which processes order and customer data on our behalf. To create invoices/delivery notes, we use the apps Order Printer Pro and Order Printer Templates. The legal basis in each case is Art. 6(1)(b) GDPR; data processing agreements pursuant to Art. 28 GDPR are in place with the service providers.

8. Contacting us

If you contact us by e-mail, contact form, telephone or via the chat/messaging function (Shopify Inbox), we process the data transmitted in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or Art. 6(1)(f) GDPR (other enquiries).

9. Newsletter (Shopify Email)

You can subscribe to our newsletter. It is sent via Shopify Email (Shopify International Limited, Ireland). Registration takes place using the double opt-in procedure. To be able to demonstrate consent, we store the time of registration and confirmation. The legal basis is Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link. To measure its success, the newsletter may include open and click tracking.

9a. Product reviews and review requests by e-mail (Judge.me)

Controller and service provider. The controller responsible for the processing is Luba Moden (for contact details see section 1). For product reviews, we use the Judge.me service of Judge.me Ltd (Company No. 12157706), c/o Buckworths, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom. Judge.me processes the data on our behalf; the basis is Judge.me's data processing agreement pursuant to Art. 28 GDPR (Data Processing Agreement). Where Judge.me processes data for its own purposes (for example for security, abuse prevention or anonymised statistics), Judge.me is itself the controller for this; information on this is available at https://judge.me/privacy.

Review request by e-mail. If you have ordered from us online, we send you a single e-mail approximately one week after your order has been shipped, asking you to review the items purchased. We do not send reminder e-mails. For this purpose, we process your name, your e-mail address, the order number, the items ordered and the shipping date. The e-mail is sent via Judge.me. The purpose is to obtain feedback on our products and to inform other customers. The legal basis is our legitimate interest in these purposes (Art. 6(1)(f) GDPR) in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG). For this, we only use the e-mail address that we received in connection with your order, and we only ask about items that you have purchased from us. If you have unsubscribed from our e-mails, you will not receive a review request.

Objection. You may object at any time to the use of your e-mail address for review requests without incurring any costs other than the transmission costs at the basic rates. To do so, use the unsubscribe link contained in every review e-mail or write to info@lubamoden.de. We already inform you of this right to object when you place your order, below the field for the e-mail address.

Publication of your review. If you submit a review, we store the star rating, your text, any photos or videos you voluntarily upload, your name, your e-mail address and the date. Only your first name and the first letter of your surname (or "anonymous" if you select this), the stars, your text, your photos or videos and the date appear on our website. Your e-mail address is not published. Anyone who submits a review via the "Write a review" button on the product page confirms their e-mail address via a link that Judge.me sends by e-mail. The legal basis is your consent, which you give by submitting the review (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by e-mail to info@lubamoden.de; we will then remove your review. Reviews that customers have submitted for our items in the Shopify app "Shop" are automatically imported by Judge.me and displayed with the note "Bewertung in Shop App geschrieben" ("written in the Shop app"); in this respect, the legal basis is our legitimate interest in also showing these already publicly submitted reviews in our shop (Art. 6(1)(f) GDPR). We read every review before it is published. We explain how we verify reviews at https://lubamoden.de/en/pages/bewertungen.

Display on the website. To display the reviews, our website loads content, for example images, from Judge.me servers. In doing so, your IP address is transmitted to Judge.me. The legal basis is our legitimate interest in the reviews being displayed properly (Art. 6(1)(f) GDPR). Only if you have consented in the cookie banner does the review widget additionally report to Judge.me that it has been displayed and viewed (usage statistics). The legal basis for this is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

Data transfers to third countries. Judge.me has its registered office in the United Kingdom. An adequacy decision of the EU Commission exists for the United Kingdom. Judge.me uses sub-processors, including in the USA (for example Amazon Web Services for hosting and Postmark for sending e-mails). For such transfers, Judge.me ensures appropriate safeguards in accordance with the data processing agreement (clause 8), in particular the EU Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, unless an adequacy decision exists. The list of sub-processors is available at https://judge.me/help/en/articles/8390001-list-of-judge-me-s-sub-processors.

Storage period. We store published reviews for as long as they are displayed on our website or until you withdraw your consent. We delete data relating to review requests as soon as they are no longer required for this purpose and no statutory retention obligations prevent this. If we stop using Judge.me, Judge.me will delete the data or return it to us, unless there is a statutory obligation to retain it.

9b. Google Customer Reviews

What this is about. After you place an order, our order confirmation page asks whether Google may send you a short email survey about your purchase from us ("Yes"/"No"). The "Google Customer Reviews" programme is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The question is integrated via the Shopify app "Google & YouTube".

What data is sent to Google. Only if you select "Yes" do we transmit your email address, the order number, the delivery country, the estimated delivery date and the language of your order to Google. If you select "No" or make no choice, this data is not transmitted to Google for the programme. After the estimated delivery date, Google sends you an email asking you to rate your purchase from us. Google may display your rating as a seller rating for Luba Moden, for example in Google Shopping and in Google ads.

Technical status message. When the question is displayed and after you make your choice, Google's app also sends a technical status message to Google (Google Analytics). It contains only the address of our shop and the status (displayed, "Yes" or "No"), no order or contact data; for technical reasons, your IP address is transmitted to Google in the process. This message is built into the app and cannot be switched off by us. The legal basis is our legitimate interest in a functioning integration of the programme (Art. 6(1)(f) GDPR).

Legal basis and withdrawal. The legal basis for transmitting your order data is your consent (Art. 6(1)(a) GDPR), which you give by selecting "Yes". It is voluntary and has no effect on your order. You can withdraw it at any time with effect for the future, via the unsubscribe link in Google's email or by emailing info@lubamoden.de; we will then forward your withdrawal to Google.

Google's responsibility. Google is itself responsible for sending the survey and for storing and publishing your rating. Google's privacy policy applies: https://policies.google.com/privacy. Information about the programme: https://support.google.com/googleshopping/answer/7163734. Google may also transfer data to the USA; Google is certified under the EU-US Data Privacy Framework (see also section 16).

Storage period. We do not store any additional data for this purpose. How long Google stores the data is governed by Google's privacy policy.

10. Electronic withdrawal function (withdrawal button)

To comply with the statutory obligation to provide an electronic withdrawal function (Section 356a of the German Civil Code (BGB)), we use the application "Revoq – EU Withdrawal Button" (provider: Buschbytes, contact: hello@buschbytes.com). If you declare a withdrawal via our online withdrawal form, we process the data provided in the process – name, e-mail address, order number, where applicable details of the items concerned, as well as the date, time and status of your withdrawal. The purpose is to receive your withdrawal, to send an acknowledgement of receipt and to process the matter.

The legal basis is Art. 6(1)(c) GDPR (legal obligation) in conjunction with Art. 6(1)(b) GDPR. The provider processes the data exclusively on our behalf (Art. 28 GDPR). Processing takes place within the EU; the sub-processors are: Supabase / PostgreSQL (Frankfurt), Fly.io (Amsterdam and Frankfurt), Resend (Ireland) and Sentry (Frankfurt). The data are deleted after 90 days, unless statutory retention obligations prevent this.

11. Web analytics: Google Analytics 4

If you have given your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data processed include the truncated IP address, device and browser information as well as interactions (e.g. page views, shopping cart, completed purchase). It is integrated via Google Tag Manager (see section 14). The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time via the cookie settings. A transfer to the USA is possible (see section 16).

12. Marketing: Google Ads and Google Merchant Center

If you have given your consent, we use Google Ads (Google Ireland Limited) to measure advertising conversions and for remarketing. In doing so, cookies are set and usage data are processed in order to measure the success of our advertisements and to show you interest-based advertising. The tools used include conversion tracking, remarketing and the transmission of enhanced conversion data (Enhanced Conversions). In connection with our product listings on Google Shopping, we also use reach and conversion measurement via Google Merchant Center. The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time via the cookie settings. A transfer to the USA is possible (see section 16).

13. Marketing: Meta Pixel and TikTok Pixel

If you have given your consent, we use:
– the Meta Pixel, including the server-side Conversions API (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), to measure advertising conversions and for interest-based advertising on Facebook and Instagram;
– the TikTok Pixel, including the server-side Events API (TikTok Technology Limited, Ireland), for corresponding purposes on TikTok.

In doing so, usage and device information is transmitted to the respective provider. The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time via the cookie settings. A transfer to third countries is possible (see section 16).

14. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited) to manage the tags used on our website (in particular Google Analytics 4 and Google Ads). The Tag Manager itself does not store any personal data, but controls the triggering of the integrated services. Tags requiring consent are only triggered after you have given your consent via the cookie banner.

15. Other functions and integrated services

Location/currency function: For the regional display of language, currency and delivery information, we use the apps Orbe Geolocation and Hextom: Translate and Currency, which evaluate, among other things, the IP address for this purpose. The legal basis is Art. 6(1)(f) GDPR.

Website search: For the search and filter function, we use Searchanise and Shopify "Search & Discovery". Search terms and usage data may be processed in this context.

Instagram feed: To display our Instagram feed, we use apps (Instafeed / GSC Instagram Feed); when the feed is accessed, data may be transmitted to Instagram (Meta).

Product recommendations and sets: For the "Frequently bought together" recommendation on product pages, we use the app "Frequently Bought Together" (Code Black Belt); the app "Bundler" is also integrated for product sets. Accessibility: For the accessibility assistance tool, we use the app "Avada Accessibility". Fonts: For the accessibility assistance tool, fonts are loaded from CDNFonts. When our pages are accessed, content is loaded for this purpose from the provider's servers; for technical reasons, your IP address is transmitted in the process. The legal basis is our legitimate interest in a functional and accessible shop (Art. 6(1)(f) GDPR). Rating badge: If you have consented to the "Marketing" category, our shop displays a badge from Google showing our seller ratings (Google Ireland Limited). Content and fonts are loaded from Google's servers, your IP address is transmitted and Google sets cookies. The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time via the cookie settings. A transfer to the USA is possible (see section 16).

16. Data transfers to third countries

Where services are used in which data are transferred to countries outside the EU/EEA (in particular the USA), this only takes place where appropriate safeguards are in place – in particular on the basis of the EU-US Data Privacy Framework (if the provider is certified) or the Standard Contractual Clauses of the EU Commission. If the transfer is based on your consent, the legal basis is Art. 49(1)(a) GDPR.

17. Rights of the data subject

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21, including to direct marketing) and to withdraw any consent given with effect for the future (Art. 7(3) GDPR). To exercise these rights, a message to the contact details stated in section 1 is sufficient.

18. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is in particular:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61, 10555 Berlin

19. Data security

We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Data transmission in the shop is encrypted (TLS/SSL).

20. Validity and amendments

This privacy policy is currently valid (for the date, see above). Further development of the website or changes to statutory requirements may make it necessary to amend it.