Privacy Policy

Last updated: 4 October 2026

This Privacy Policy explains, in accordance with Art. 13 and 14 of the EU General Data Protection Regulation (GDPR), how and for what purposes we process your personal data. The controller is Shoppi UG (haftungsbeschränkt), Kolonnenstr. 8, 10827 Berlin, Germany, email: [email protected], which operates the platform. For any question about data protection you can reach us at [email protected].

Users in the United States: for orders from the United States your contracting party is Shoppi Inc., 1 Radisson Plaza, Suite 800, New Rochelle, NY 10801, USA. We do not sell your personal information for money. The Meta Pixel described below can count as "sharing" for targeted advertising under some US state laws; it is only loaded if you accept it in the cookie banner, and you can withdraw that choice at any time. Depending on your state of residence, you may have the right to know, access, correct and delete your personal information and to opt out of targeted advertising; we will not discriminate against you for exercising these rights. To make a request, email [email protected].

We process your IP address (172.71.28.135) to ensure network and information security, for example to log the last login attempt (Art. 6(1)(f) GDPR). Log files are deleted after 30 days at the latest, unless they are needed to investigate a security incident.

Cookies

We use strictly necessary cookies, without which the website, login and shopping cart do not work. We set them without consent (Art. 6(1)(b) and (f) GDPR and the applicable cookie rules). All other cookies and similar technologies (statistics and marketing, see below) are only set if you have accepted them in the cookie banner (Art. 6(1)(a) GDPR). Without your consent they are not loaded.

Strictly necessary cookies:

PHPSESSID / Uid (duration: session or up to 1 year) – session management and unique user identifier.

Login_Key (duration: 30 days) – keeps you logged in if you choose to; recognises your login by means of a time-sensitive hash.

isAuth / isMerchant (duration: session) – mark your login and customer status.

Completeprofile (duration: 1 year) – marks your profile type (private or business customer).

cart_hash (duration: 30 days) – links your shopping cart to you.

page_locale / countries-selected (duration: up to 3 hours) – store the language and market (country) you chose, so that we show you the right offers.

LATITUDE / LONGITUDE / GEOIP_RENEW (duration: up to 1 day) – approximate city-level location derived from your IP address, to show you merchants near you. We do not collect your precise location.

cookieConsent (duration: 1 year) – stores your choice in the cookie banner.

Cloudflare – CDN and security functions; the provider is Cloudflare Inc., USA. Data transfers are based on Standard Contractual Clauses (Art. 46 GDPR). More information is available in their privacy guide.

You can withdraw your consent to non-essential cookies at any time with effect for the future by deleting this website's cookies in your browser; the cookie banner will then appear again on your next visit.

Analytics

On some pages we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), only after your consent (Art. 6(1)(a) GDPR). Google Analytics 4 does not store full IP addresses. Data may be transferred to Google LLC in the USA on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses (Art. 45, 46 GDPR). You can withdraw your consent at any time with effect for the future, for example through the cookie banner or the browser add-on. Analytics data is deleted automatically after 14 months.

Marketing

Meta Pixel: with your consent (Art. 6(1)(a) GDPR) we use the Meta Pixel of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) to measure the success of our advertising on Facebook and Instagram and to show you relevant ads there. Your IP address, browser data and the pages you visit are sent to Meta; we and Meta are joint controllers for this collection and transmission (Art. 26 GDPR). Data may be transferred to Meta Platforms Inc. in the USA (EU-US Data Privacy Framework or Standard Contractual Clauses). The pixel is not loaded without your consent in the cookie banner.

You only receive marketing emails if you have agreed to them beforehand (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by following the opt-out link in every email or by changing your settings in your customer account.

Unsubscribing and account deletion: through this link you unsubscribe from our emails; your account is not affected. If you also want to deactivate your account, you can request this there in a second step: we then send a confirmation link to your email address, and the account is only deactivated after you open it. Open orders are still completed; after that we delete your data, unless we are legally required to keep it (for example invoices for up to 10 years). You can also ask for deletion at any time by emailing [email protected].

Data processing

We personalise your content feed based on your use of the site (for example categories you viewed). No automated decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR take place. The legal basis is our legitimate interest in a user-friendly website (Art. 6(1)(f) GDPR); you can object to this processing at any time (Art. 21 GDPR). The data is deleted after 180 days at the latest ("data pruning").

Hosting & CDN: our servers run on Oracle Cloud Infrastructure in the Frankfurt am Main data centre (Germany). To deliver images and static assets we use ImageKit.io (EU location) and Cloudflare CDN. Where this involves a transfer of data to third countries, it is based on Standard Contractual Clauses under Art. 46 GDPR.

Security

We take technical and organisational measures under Art. 32 GDPR (for example TLS encryption, firewalls, role-based access management) to protect your data against loss, misuse or unauthorised access. Please note that complete security of data transmitted over the internet cannot be guaranteed.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to certain processing (Art. 21). You can also withdraw any consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

If the GDPR applies to you, you can complain at any time to a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

Updates to this Privacy Policy

We review this Privacy Policy regularly to adapt it to changes in the law or in our services. The date of the last update is shown at the top of this page. We will inform you of significant changes through our portal or by email.

Contact

We are happy to answer questions about data processing at [email protected] or by post at the address above.