Privacy policy

Last updated: October 2026

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation, GDPR (DSGVO), is:

Yará Hair
Owner: Jennifer Yeboah
Geschwister-Scholl-Straße 81
28327 Bremen
Phone: +49 178 4814432
Email: yara.official@yahoo.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

Personal data is any data that can be used to identify you personally, for example your name, address, email address or IP address. We only process this data insofar as this is necessary to operate the online shop, process your order, communicate with you, or on the basis of your consent.

The most important legal bases are:

  • Art. 6(1)(a) GDPR (DSGVO) (consent)
  • Art. 6(1)(b) GDPR (DSGVO) (contract and pre-contractual measures)
  • Art. 6(1)(c) GDPR (DSGVO) (legal obligations, e.g. retention obligations)
  • Art. 6(1)(f) GDPR (DSGVO) (legitimate interests, e.g. secure and stable operation of the shop)
  • § 25(1) and (2) TDDDG (storing and accessing information on your device, e.g. cookies)

3. Hosting and shop system: Shopify

Our online shop is operated via the Shopify platform. The provider for merchants in Europe is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland (Shopify). Shopify processes on our behalf all data generated when you visit the shop and place an order, and stores it on its servers. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR (DSGVO).

Shopify may transfer data to affiliated companies in Canada (Shopify Inc.) and the USA as well as to sub-processors. An adequacy decision of the EU Commission exists for Canada. For transfers to the USA, Shopify relies on the EU-US Data Privacy Framework or on the EU Commission’s standard contractual clauses. The legal basis is Art. 6(1)(b) and (f) GDPR (DSGVO). Further information: www.shopify.com/de/legal/datenschutz.

Shopify also processes some data under its own responsibility, for example for fraud prevention and for Shop Pay. You can find information on this in Shopify’s privacy policy for consumers.

4. Accessing the website and server log files

When you access our shop, technical information transmitted by your browser is processed automatically: IP address, date and time of access, page accessed, referrer URL, browser type and operating system. This data is required to deliver the website and to ensure its security and stability (Art. 6(1)(f) GDPR (DSGVO)). The connection is encrypted via SSL/TLS.

5. Cookies and consent

Our shop uses cookies and similar technologies. We set technically necessary cookies (e.g. for the shopping cart, the checkout process, language selection and storing your cookie settings) on the basis of § 25(2) no. 2 TDDDG and Art. 6(1)(b) and (f) GDPR (DSGVO).

We only set all other cookies, for example for statistics on the use of the shop or for marketing, with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR (DSGVO)). We obtain your consent via Shopify’s cookie banner. You can withdraw or change your consent at any time with effect for the future via the cookie settings in the shop.

6. Orders and customer account

When you place an order, we process the data required to process it: name, delivery and billing address, email address, telephone number if applicable, products ordered, payment and shipping information. The legal basis is Art. 6(1)(b) GDPR (DSGVO). Mandatory fields are marked in the ordering process; without this information we cannot conclude the contract.

You can voluntarily create a customer account to view your orders. You log in using a code that we send you by email. You can request the deletion of your account at any time.

7. Payment service providers

For payment, we pass on the necessary payment data to the payment service provider you have chosen (Art. 6(1)(b) GDPR (DSGVO)):

  • Shopify Payments (credit and debit card, Apple Pay, Google Pay, Shop Pay): Payments are processed via Shopify in cooperation with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Card data is not stored by us.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal is itself responsible for processing in connection with its service. Privacy policy: www.paypal.com/de/legalhub/privacy-full.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose a Klarna payment method, we transmit contact, order and address data to Klarna so that Klarna can process the payment and carry out an identity and credit check (Art. 6(1)(b) and (f) GDPR (DSGVO)). Klarna is itself responsible for this. Privacy policy: www.klarna.com/de/datenschutz.

Payment service providers may carry out their own checks for fraud prevention and identity verification.

8. Shipping

For delivery, we pass on your name and delivery address to the commissioned shipping company (Art. 6(1)(b) GDPR (DSGVO)). We only pass on your email address or telephone number if you have expressly consented to this during checkout so that the carrier can inform you about the delivery (Art. 6(1)(a) GDPR (DSGVO)). You can withdraw this consent at any time.

9. Contact by email, contact form and withdrawal function

If you write to us by email, via the contact form or via the “Withdraw from contract” function, we process your details (e.g. name, email address, order number, message) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (DSGVO) insofar as your request concerns an order or a contract, otherwise Art. 6(1)(f) GDPR (DSGVO). Our email mailbox is provided by Yahoo (Yahoo EMEA Limited, Dublin, Ireland).

10. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about new products and offers. The legal basis is your consent (Art. 6(1)(a) GDPR (DSGVO)). To ensure that no one can register someone else’s email address, you confirm your subscription via a link in a confirmation email (double opt-in). The newsletter is sent via Shopify Email. This may include analysing whether a newsletter was opened and which links were clicked. You can unsubscribe at any time via the unsubscribe link in every email.

11. Storage period

We only store personal data for as long as is necessary for the respective purpose. We retain order and invoice data for up to ten years due to commercial and tax law obligations (§ 257 HGB, § 147 AO). We store newsletter data until you unsubscribe.

12. Your rights

You have the right at any time to access (Art. 15 GDPR (DSGVO)), rectification (Art. 16 GDPR (DSGVO)), erasure (Art. 17 GDPR (DSGVO)), restriction of processing (Art. 18 GDPR (DSGVO)), data portability (Art. 20 GDPR (DSGVO)) and the right to withdraw any consent given with effect for the future (Art. 7(3) GDPR (DSGVO)).

Right to object: Insofar as we process data on the basis of Art. 6(1)(f) GDPR (DSGVO), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR (DSGVO)). You may object to the use of your data for direct marketing at any time without giving reasons.

A short message to yara.official@yahoo.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen), Arndtstraße 1, 27570 Bremerhaven, www.datenschutz.bremen.de.

13. Changes

We will update this privacy policy if our shop or the legal situation changes. The version published here applies.