Privacy Policy
We respect your privacy. This policy explains what data we collect, why, and what rights you have under the GDPR.
Data Controller
The entity responsible for your personal data is:
We respond to all privacy inquiries within 72 hours.
Data We Collect
When you place an order
- Full name and email address
- Shipping address
- Phone number (optional)
- Payment data — processed by Stripe or PayPal directly. We never store your card number.
- Order contents and transaction amount
When you create an account
- Email address and hashed password (never stored in plain text)
- Name, saved addresses, order history, wishlist items
Automatically collected
- IP address and browser type (anonymised for analytics)
- Pages visited and referral source via Google Analytics
- Device type and operating system
- Cookie identifiers (see Cookies section)
How We Use Your Data
Fulfilling your order
Contract — Art. 6(1)(b) GDPR
Processing payment, creating order records, dispatching items, sending order updates.
Customer support
Contract — Art. 6(1)(b) GDPR
Responding to enquiries, managing returns and refunds.
Marketing emails
Consent — Art. 6(1)(a) GDPR
Promotional emails only if you opted in. Unsubscribe at any time via the link in any email.
Site analytics
Legitimate interest — Art. 6(1)(f) GDPR
Google Analytics with IP anonymisation enabled. Used to improve the shopping experience.
Legal and tax compliance
Legal obligation — Art. 6(1)(c) GDPR
Order records kept for 10 years per § 147 Abgabenordnung (German tax law).
Third-Party Processors
We never sell your data. We share only what each processor needs to perform their service, under binding contracts.
Retention Periods
- Order records: 10 years — required by § 147 Abgabenordnung (German tax law)
- Account data: active while your account exists, deleted within 30 days of deletion request
- Marketing consent: until you unsubscribe
- Analytics data: 14 months (shortened from Google default)
- Support correspondence: 2 years
International Data Transfers
Stripe, PayPal, Google Analytics, and Resend are based in the United States. Transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR, ensuring equivalent protection.
Your Rights Under GDPR
Email contact@evapatch.com to exercise any of these rights. We respond within 30 days as required by law.
Access (Art. 15)
Request a copy of all personal data we hold about you.
Rectification (Art. 16)
Correct inaccurate or incomplete data.
Erasure (Art. 17)
Request deletion where no legal retention obligation exists.
Restriction (Art. 18)
Limit our processing while a dispute is resolved.
Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Objection (Art. 21)
Object to processing based on legitimate interest, including direct marketing.
Withdraw consent
Withdraw any consent given (e.g. marketing emails) at any time without affecting prior lawful processing.
Contact & Supervisory Authority
Husarenstraße 30, 53117 Bonn, Germany
www.bfdi.bund.de