-
Sold out -
Sold outExtreme Lip Plumper
Regular price From 24,99€Regular price From 24,99€ Sale priceUnit price per34,99€Sold out -
Sold outVolume Lip Gloss
Regular price 11,99€Regular price 11,99€ Sale priceUnit price per14,99€Sold out -
Sold out -
Sold out
-
Free Shipping from 30€
-
Bundle-Deals for Masks!
-
Easy Returns
Menu
We also do this thing with cookies. They help us to make our site better. Does that work for you?
I want to know more.
FURTHER INFORMATION
1. Controller and privacy contacts
Geminos Limited operates Yunelle and is the controller of the personal data described in this policy.
Geminos Limited
A private company limited by shares incorporated in Hong Kong
Business Registration Number: 80955528
Flat 5, 4/F, Won Hing Building
74-78 Stanley Street
Central, Hong Kong
Represented by its director: Geminos Limited
E-mail: legal@yunelle.com
EU contact for data protection matters
Geminos Limited
E-mail: legal@yunelle.com
You may send privacy enquiries and requests to exercise your rights to either contact above. You do not need to contact Hong Kong first. Geminos Limited remains responsible for its processing.
The GDPR applies to processing connected with offering goods to people in the European Union or monitoring their behaviour there, as provided by Art. 3 GDPR. Hong Kong's Personal Data (Privacy) Ordinance also applies where its conditions are met.
2. General information
2.1 Scope of processing
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Any processing beyond that takes place only with your consent or on one of the other legal bases set out in Art. 6 GDPR.
2.2 Legal bases
Where we obtain consent, the legal basis is Art. 6(1)(a) GDPR. Processing necessary to perform a contract or take steps at your request before entering into a contract is based on Art. 6(1)(b) GDPR. Processing necessary to comply with an obligation under EU or Member State law is based on Art. 6(1)(c) GDPR. Processing necessary for our legitimate interests or those of a third party is based on Art. 6(1)(f) GDPR, unless your interests or fundamental rights override those interests.
Our interests in keeping lawful business records and establishing, exercising or defending legal claims may also require retention of data. A Hong Kong legal obligation is not, by itself, a legal basis under Art. 6(1)(c) GDPR; where the GDPR applies, such retention requires a separate basis, including Art. 6(1)(f) subject to the balance of interests described above.
For storing information on your device and accessing information already stored, Section 25 TDDDG applies in addition where applicable. Unless this is strictly necessary to provide a service you have expressly requested, we obtain your consent via our consent banner.
2.3 Erasure and storage period
We retain personal data for the purpose for which it was collected and for applicable statutory retention periods. The period depends on the record type, the applicable law, outstanding orders or enquiries, and the need to establish, exercise or defend legal claims. Data retained solely for legal or evidential reasons is restricted to those purposes. Section 15 explains the relevant periods and criteria.
3. Hosting and provision of the website
3.1 Shopify
Our shop uses Shopify for hosting, the storefront, ordering and checkout. The Shopify contracting entity for our Hong Kong billing address is Shopify Commerce Singapore Pte. Ltd., 77 Robinson Road, #13-00 Robinson 77, Singapore 068896. Shopify group companies, including Shopify Inc. in Canada and Shopify International Limited in Ireland, also take part in providing the platform.
Shopify processes customer data on our behalf under its Data Processing Addendum, incorporated into its service terms. Shopify also acts as a controller for its own customer services, such as Shop and Shop Pay, and for Enhanced Services described in its terms. Such services can use interactions with our shop, other merchants and Shopify. Further information and rights relating to Shopify's own processing are set out in the Shopify Consumer Privacy Policy.
We also use Shopify Flow for internal workflows, Shopify Subscriptions for recurring orders, and Translate & Adapt for shop content. These functions operate within the Shopify platform.
Shopify and its subprocessors process data internationally, including in Singapore, Canada, Ireland and the United States. Its published DPA describes Binding Corporate Rules for relevant transfers between Shopify entities, and Standard Contractual Clauses or adequacy decisions where applicable. See section 14 for further information.
Our legal basis is Art. 6(1)(b) GDPR for contract performance and Art. 6(1)(f) GDPR for secure and efficient shop operation. Consent-based analytics, advertising and non-essential tracking are covered by sections 4 and 11.
3.2 Server log files
Each time our website is accessed, our system automatically collects data from the accessing device. This includes in particular the IP address, the date and time of access, the page accessed, the previously visited page, the browser used including version, the operating system and the volume of data transferred.
This data is technically necessary in order to deliver the website, ensure its stability and detect attacks. We do not combine this data with other data sources. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technical provision and security of our online offering.
3.3 SSL and TLS encryption
For security reasons, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://". When encryption is active, the data you transmit to us cannot be read by third parties.
4. Cookies, consent and similar technologies
Our website uses cookies and comparable technologies such as pixels and the browser's local storage. Cookies are small text files stored on your device.
4.1 Strictly necessary cookies
Certain cookies are required for the shop to function at all. These include in particular cookies that store the contents of your basket, recognise your session, remember your chosen language and country, and secure the checkout. These cookies are set by Shopify. The legal basis for storage is Section 25 (2) no. 2 TDDDG, and for the subsequent processing Art. 6 (1) (f) GDPR.
4.2 Cookies requiring consent
We only use cookies and technologies beyond that, in particular for analytics, marketing and reach measurement, if you have previously given your consent via our consent banner. The legal basis is Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.
4.3 Withdrawing your consent
You may withdraw your consent at any time with effect for the future. To do so, open the consent banner again via the corresponding link on our website and change your selection. The lawfulness of processing carried out until withdrawal remains unaffected. You can also delete cookies in your browser settings or restrict their storage from the outset. If you disable all cookies, some functions of our shop may no longer be available.
4.4 Managing your consent
To obtain, manage and document your consent we use the application Pandectes GDPR Compliance. On your first visit the banner presents the available options and holds back scripts requiring consent until you have made your choice.
To document your decision, a randomly generated consent ID, the time of your decision, the categories you selected, the domain accessed and a truncated IP address are stored. This data is used solely to demonstrate consent. The provider acts as our processor within the meaning of Art. 28 GDPR.
The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR, as we are legally required to be able to demonstrate the consent given.
5. Order processing and performance of the contract
When you place an order in our shop, we process the data required to handle your order. This comprises your first and last name, billing and delivery address, e-mail address, phone number where provided, the items ordered, the order value, the chosen payment and shipping method, the order date and information on the payment status.
We need this data in order to conclude and perform the contract with you, to keep you informed about the status of your order, to answer queries and to handle returns, withdrawals and warranty claims. The legal basis is Art. 6 (1) (b) GDPR. For the retention of invoicing and accounting data, the legal bases and retention criteria described in sections 2.2 and 15 apply.
5.1 Delivery address validation
To avoid delivery failures we use the application AddressHero. It checks the delivery address you enter for formal completeness and plausibility, detects missing house numbers or mismatched postcode and city details, for example, and suggests a correction where appropriate. Only the address data of your order is processed in this context. The application acts as our processor within the meaning of Art. 28 GDPR.
The legal basis is Art. 6 (1) (b) GDPR, as a deliverable address is necessary for the performance of the contract.
5.2 Disclosure to service providers
For order fulfilment we share the necessary data with payment, shipping and fulfilment providers. Other disclosures, including to marketing and analytics providers, are described separately below with their purposes and legal bases.
6. Payment processing
We use external payment service providers to process payments. When you choose a payment method, the data required for that method is transmitted to the respective provider. Full payment details such as card numbers or bank details are entered directly with the payment service provider and are not disclosed to us in plain text.
The respective payment service provider is independently responsible under data protection law for the processing of your payment data. Its own privacy notices and terms apply in this respect. Payment service providers carry out checks on their own responsibility to protect against payment default and fraud, and may transmit data to credit agencies in doing so.
The legal basis for the transfer is Art. 6 (1) (b) GDPR where it is necessary for the performance of the contract, and Art. 6 (1) (f) GDPR with regard to our legitimate interest in secure and smooth payment processing.
7. Shipping and logistics
7.1 Shipping within Germany
For shipments to Germany we transmit your name, your delivery address and, where required for delivery, your e-mail address or phone number to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. DHL needs this data for delivery and for shipment notifications.
To create shipping labels and transfer shipment data to DHL, we use the Shopify application easyDHL. It processes the shipping data described above on our behalf as a processor pursuant to Art. 28 GDPR.
The legal basis is Art. 6 (1) (b) GDPR.
7.2 Shipping to the United States and transfer to a third country
Orders to the United States are picked and dispatched by our logistics partner, a fulfilment service provider based in the People's Republic of China. For this purpose we transmit to that provider your name, your full delivery address, your phone number and e-mail address where provided, and the details of the items ordered.
The technical transfer of this order data to the logistics partner is carried out via the application HyperSKU, which acts as our processor within the meaning of Art. 28 GDPR. HyperSKU receives the order data from our shop, forwards it to the fulfilment site and subsequently returns the tracking number to our shop.
The logistics provider receives the data to fulfil your US delivery. Where the GDPR applies, necessary order processing is based on Art. 6(1)(b) GDPR. This processing basis does not by itself authorise an international data transfer. Mainland China has no adequacy decision from the European Commission; section 14 explains the separate rules for international transfers.
For US customs clearance, necessary shipment data may also be disclosed to customs and border authorities. Necessary processing for the agreed international delivery is based on Art. 6(1)(b) GDPR where the GDPR applies; processing required by EU or Member State law is based on Art. 6(1)(c) GDPR. The separate requirements for international transfers remain applicable.
7.3 Order tracking
On our order tracking page you can enter your tracking number to retrieve the current status. The tracking number you enter is transmitted to the respective shipping service provider in order to query the status. The legal basis is Art. 6 (1) (b) GDPR.
8. Customer account
You can create a customer account in our shop. We then store the data you provide together with your order history, so that you do not have to re-enter your details for future orders and can view your orders. Login is handled by Shopify's account service.
We store the data in your customer account until you delete the account. You can delete it yourself at any time or notify us at legal@yunelle.com. Statutory retention obligations for orders already processed remain unaffected.
The legal basis is Art. 6 (1) (b) GDPR.
9. Contact and customer service
9.1 Contact form, e-mail and chat
If you contact us via our contact form, by e-mail or via the chat on our website, we process the data you transmit in order to respond to your enquiry. This is usually your name, your e-mail address, your order number where applicable, and the content of your message including any attachments.
To handle customer enquiries and for the chat function we use the application Commslayer. Commslayer consolidates incoming enquiries from e-mail and chat in a helpdesk system and processes the data described above on our behalf as a processor pursuant to Art. 28 GDPR. In order to answer your enquiry, the system may access your order and customer data stored with Shopify. Where functions for the automated preparation of replies are used, this serves solely to support our staff. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.
In addition we use Shopify Inbox for messages that reach us through the Shopify platform and its connected sales channels. This processing takes place within the Shopify platform.
The legal basis is Art. 6 (1) (b) GDPR where your enquiry concerns a contract with us, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in responding to enquiries.
We erase the enquiry once it has been conclusively dealt with and no statutory retention obligations apply.
9.2 Withdrawal form
You can declare your withdrawal online via our withdrawal page. We process the data entered there, in particular your name, order number and e-mail address, solely in order to handle your withdrawal. To provide this function we use the application EU Widerruf Button, which acts as a processor on our behalf. The legal basis is Art. 6 (1) (b) and (c) GDPR.
10. E-mail marketing and service messages
10.1 Transactional e-mails
In connection with your order we send you order confirmations, shipping notifications and comparable messages that form part of contract performance. These messages are not advertising and are sent via Shopify. The legal basis is Art. 6 (1) (b) GDPR.
10.2 Newsletter via Klaviyo
For sending our newsletter and for marketing messages by e-mail and SMS we use Klaviyo. The provider is Klaviyo Inc., 125 Summer Street, Boston, MA 02110, United States.
When you sign up for our newsletter, the e-mail address you provide and, where given, your name and phone number are transmitted to Klaviyo and stored there in a profile. Registration uses the double opt-in procedure: after signing up you receive an e-mail containing a confirmation link. Only after you confirm do we add you to the mailing list. To document your consent, we store the time of registration and confirmation and the IP address used.
Klaviyo also records whether and when you opened a message and which links you clicked in it. This is done using tracking pixels and individualised links. We use the results to tailor our messages to the interests of our recipients. This analysis forms part of your consent.
Klaviyo can link profile data with the order data stored with Shopify in order to send you relevant content, for example a reminder about an order you did not complete.
You can unsubscribe from the newsletter at any time. Every message contains an unsubscribe link. Alternatively, an informal message to legal@yunelle.com is sufficient. Unsubscribing also withdraws your consent to the analysis of your usage behaviour.
A transfer to the United States takes place. Klaviyo bases this transfer on the European Commission's Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR. Klaviyo acts as our processor within the meaning of Art. 28 GDPR.
The legal basis is Art. 6 (1) (a) GDPR, and for logging the consent additionally Art. 6 (1) (f) GDPR.
Further information can be found in Klaviyo's privacy policy at https://www.klaviyo.com/legal/privacy
11. Analytics, reach measurement and marketing
We only use the services described in this section if you have previously given your consent via our consent banner. The legal basis in each case is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Until you give your consent, the relevant scripts are not executed and no cookies or similar identifiers are set or read for these purposes. You may withdraw your consent at any time with effect for the future, without any disadvantage to you.
11.1 Technical integration of the measurement and marketing services
Some of the services described below are not embedded directly in the source code of our pages, but are integrated via the Customer Events function provided by Shopify. Shopify executes the relevant code in an isolated environment inside your browser, a so-called sandbox, and makes available to it only the events that occur on our website. These are in particular page views, use of the search function, product views, adding an item to the cart, initiation of checkout and completion of a purchase including order value and order contents.
Some of the measurement data is not transmitted directly to the respective provider, but is first collected via an endpoint on our own domain and forwarded to the provider from there. The scope of the data processed does not change as a result. We point this out because such a transmission is not readily recognisable in the browser as a transfer to a third party.
Where providers additionally receive events on a server-to-server basis, for example via a Conversions API or Events API, we transmit information about the event as well as contact data as hash values (pseudonymised identifiers) so that the provider can attribute the transaction to an account. This transmission also only takes place after you have given your consent.
11.2 Google tag and Google Consent Mode
We use the Google tag to control the Google services described below. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For processing outside the European Economic Area, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, is responsible.
The Google tag is a control script. It does not itself contain any analytics or advertising function, but loads and configures the Google services we have set up. When the script is loaded, your IP address is transmitted to Google.
The Google tag we use has the identifier GT-NN6CWQ78. It was set up via the Shopify integration of the Google sales channel and controls the transmission of data to our Google Ads account and to our Google Analytics property.
We use Google Consent Mode. The decision you make via our consent banner is passed on to Google and controls whether Google may set cookies, process advertising identifiers and deliver personalised advertising. This affects the settings for analytics storage, advertising storage, use of advertising data and advertising personalisation.
You can find further information at https://policies.google.com/privacy
11.3 Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited. The service helps us understand how our website is used, which pages and products are viewed, through which channels visitors reach us and at which point order processes are abandoned.
The data processed includes in particular a pseudonymous user identifier, the pages and screens you view, time spent and interactions, information about your browser, operating system, device type and screen resolution, your language and country setting, the referring page, the advertising parameters of the ad through which you arrived, and e-commerce events such as product view, cart, initiation of checkout and completion of a purchase including order value, currency and order number.
Your IP address is transmitted to Google servers. According to Google, in Google Analytics 4 it is used solely to derive coarse location information and is not stored in the reports. Google uses cookies for this service, in particular those named _ga and _ga_ followed by an identifier of our data stream. Their storage period is up to 24 months.
Google processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The retention period for the event-based usage data is governed by the period we have configured in Google Analytics.
11.4 Google Ads with conversion tracking and remarketing
We advertise using Google Ads, the advertising programme of Google Ireland Limited. Our Google Ads account has the conversion identifier AW-16978234425. We use two functions in this context.
Conversion tracking measures whether a click on one of our ads has led to an order or to another action defined by us. For this purpose, a cookie containing a click identifier is set when an ad is clicked, in particular cookies named _gcl_au and _gcl_aw. If an order is subsequently placed in our shop, it is attributed to the ad and the order value is transmitted to Google. The storage period of these cookies is up to 90 days.
Remarketing enables us to display ads for our products to you on websites and in services within the Google advertising network after you have visited our shop. For this purpose your browser sends requests to Google servers, in particular to the areas for audience lists and for conversion capture. The data processed includes a pseudonymous advertising identifier, your IP address, information about your device and the products and categories you have viewed.
Where we use enhanced conversions, we additionally transmit contact data from your order to Google, in particular your e-mail address, as a hash value rather than as a plain-text field. Google uses this information to attribute an order to an ad click. Hashing is pseudonymisation, not anonymisation: Google can use the hash to match the data with information it already holds.
If you are logged in to a Google account, Google may link the information collected to your account and use it for account-based advertising. We have no influence over this. You can deactivate personalised advertising in the settings of your Google account at https://adssettings.google.com
11.5 Meta Pixel and Conversions API
We use the visitor action pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to track the behaviour of users after they have been redirected to our website by clicking on a Meta advertisement. This makes it possible to evaluate the effectiveness of our ads and to display interest-based advertising to users on Facebook and Instagram.
The data processed includes in particular your IP address, information about your device and browser, the pages you view and events such as viewing a product, adding an item to the cart and completing a purchase including order value. Meta sets cookies for this purpose, in particular a cookie named _fbp, with a storage period of up to 90 days. In addition, we transmit events to Meta on a server-to-server basis via the Conversions API; contact data is transmitted exclusively as a hash value.
Meta may link this data to your user account if you are logged in to Meta and use it for its own advertising purposes. With regard to the collection and transfer of the data, we are joint controllers together with Meta within the meaning of Art. 26 GDPR. A transfer to the United States takes place. Meta Platforms Inc. is certified under the EU-US Data Privacy Framework, so that an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies in this respect.
You can find further information in Meta's privacy policy at https://www.facebook.com/privacy/policy
11.6 TikTok Pixel and Events API
We use the pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. The service serves the same purpose as the Meta Pixel: it measures the effectiveness of our ads on TikTok and enables the delivery of interest-based advertising.
The data processed includes in particular your IP address, device and browser information, the pages you view and events such as product view, cart and purchase. TikTok sets cookies for this purpose, in particular cookies named _ttp and ttclid. In addition, we transmit events to TikTok on a server-to-server basis via the Events API; contact data is transmitted exclusively as a hash value. A transfer to third countries, in particular to the United States and Singapore, takes place and is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
You can find further information at https://www.tiktok.com/legal/page/eea/privacy-policy/en
The Meta Pixel and the TikTok Pixel are technically integrated via the Shopify application Infinite FB & TikTok Pixels, which acts as a processor on our behalf.
11.7 TikTok Shop
We additionally offer our products via TikTok Shop and use the corresponding Shopify integration to synchronise product data, stock levels and orders between our shop and TikTok Shop. If you place an order via TikTok Shop, your order and delivery data is transmitted to us by TikTok so that we can fulfil the order. TikTok is independently responsible for the processing of your data within the TikTok platform.
The legal basis for processing the order data transmitted to us is Art. 6(1)(b) GDPR.
11.8 Triple Whale
We use Triple Whale, a service for analysing marketing channels and attributing orders to advertising measures. The provider is Triple Whale Inc., United States.
The data processed includes pseudonymous identifiers, information about the ad or channel through which you reached our website, your behaviour in the shop and order information. Triple Whale combines this information in order to show us which advertising measures lead to orders. Part of this collection takes place via an endpoint on our own domain. A transfer to the United States takes place.
11.9 Session recording by Propel Replays
We use Propel Replays, a service for recording usage sessions. The service records how you use our website: mouse movements, clicks, scrolling behaviour, page views, time spent, screen size, browser and approximate location based on your IP address. From these recordings the service creates a playable reproduction of your visit.
We use these recordings exclusively in order to identify usability problems in our shop and to improve user guidance. Entries in form fields, in particular payment data, passwords and address data, are not recorded in plain text by the service.
Because this recording goes far beyond what is necessary for the operation of the shop, it only takes place after your express consent.
11.10 Onsite tracking by Klaviyo
In addition to sending messages, we also use Klaviyo to observe usage behaviour on our website. For this purpose Klaviyo embeds a script that uses cookies and your browser's local storage.
The data collected includes in particular the pages and products you view, your cart activity, abandoned order processes and your interaction with sign-up forms displayed to you. If you have signed up for our newsletter, Klaviyo can attribute this behaviour to your profile and enable us to send you messages tailored to it, for example a reminder about a product you viewed or about a purchase you did not complete.
This processing goes beyond what is necessary for the operation of the shop and only takes place after you have given your consent.
11.11 Affiliate tracking by GOAFFPRO
We work with partners who advertise our products and receive a commission if a purchase is made via their referral link. We use the GOAFFPRO application to attribute these referrals.
If you reach our shop via a referral link, a cookie containing a partner identifier and a timestamp is set. If an order is placed within the validity period of this cookie, it is attributed to the respective partner and the order value is transmitted for the calculation of the commission. Our partners do not receive any personal data about you, only the information that an order of a certain value has been placed.
The data processed comprises the partner identifier, the time of access, a pseudonymous identifier and, in the event of an order, the order number and order value.
11.12 Sales promotion features
We use the applications One Click Upsell (provider: Zipify Apps LLC, United States), EG Auto Add to Cart and Discount Notification & Input.
One Click Upsell displays supplementary offers after the completion of a purchase which you can add to your existing order with a single click. EG Auto Add to Cart automatically adds items to your cart according to rules defined by us, for example a free product once a certain order value is reached or the second unit of a promotional offer. Discount Notification & Input points out available discounts and indicates whether a discount code is active.
The data processed comprises the contents of your cart, the products you have viewed, active discount codes and, in the case of an additional purchase, the associated order data.
Insofar as these functions serve directly to process a purchase initiated by you, the legal basis is Art. 6(1)(b) GDPR. Insofar as they go beyond this and serve analysis or personalisation purposes, they are only used after you have given your consent pursuant to Art. 6(1)(a) GDPR.
12. Other integrated services
12.1 Google fonts
In connection with the services described in section 11, your browser loads font files from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address is transmitted to Google in the process. Google may process this information and transfer it to the United States. Google LLC is certified under the EU-US Data Privacy Framework.
As these font files are loaded exclusively in the context of the consent-based services, the legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The fonts used for the display of our shop itself are served from our own server, without any connection to Google being established. You can find further information at https://policies.google.com/privacy
12.2 Delivery of theme functions via external servers
For the presentation and functionality of our shop design we embed scripts that are delivered from the servers of our theme provider. When these files are loaded, your IP address is transmitted to the respective server. This is technically necessary for the page to be displayed correctly.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the reliable and performant delivery of our online offering.
12.3 Administrative access
To administer and maintain our shop we use applications that operate exclusively within the Shopify administration area, in particular Section Store for providing design components and interface applications supporting the maintenance of shop content. These applications access shop and product data and may technically also access order and customer data. No processing of your data for these providers' own purposes takes place. The legal basis is Art. 6 (1) (f) GDPR.
12.4 Translation of shop content
For the translation of product texts and images we use the applications Translate & Adapt and EZ Product Translate, which access the content of our shop. No personal data of visitors is processed in the process.
13. Our social media profiles
We maintain profiles on Instagram, TikTok, YouTube and Pinterest and link to them from our website. The links are simple hyperlinks. Data is only transmitted to the respective provider once you click a link.
If you visit our profiles, the respective provider processes your data on its own responsibility in accordance with its own terms. Where the provider makes aggregated statistics about the use of our profile available to us, we are joint controllers with the provider in that respect pursuant to Art. 26 GDPR. We have no influence on the processing carried out by the provider and receive no access to individual user profiles.
The legal basis for our presence is Art. 6 (1) (f) GDPR. Our legitimate interest lies in our external presentation and in communicating with prospective customers.
14. Processing in Hong Kong and international transfers
Geminos Limited is established in Hong Kong. Data relating to shop administration, orders and customer enquiries can be processed there by the company and its authorised personnel. Our EU contact is in Germany. The locations of our company and contacts do not change the GDPR rights that apply to your data.
Our service providers also process data in countries outside the European Economic Area, particularly the United States, Canada, Singapore, India and mainland China. US recipients include Google LLC, Meta Platforms Inc., TikTok Inc., Klaviyo Inc., Triple Whale Inc. and Zipify Apps LLC. Singapore recipients include Shopify Commerce Singapore Pte. Ltd. and TikTok Pte. Ltd. The China fulfilment workflow and HyperSKU are described in section 7.2.
The European Commission has not issued adequacy decisions for Hong Kong, mainland China, Singapore or India. Its Canadian adequacy decision covers commercial organisations within its scope. The EU-US Data Privacy Framework adequacy decision covers transfers to participating US organisations only within their certification's scope.
Shopify's published transfer arrangements are described in section 3.1. The provider-specific information elsewhere in this policy describes the respective services; it does not mean that a US adequacy decision also covers processing in Hong Kong or mainland China.
Where a disclosure is an international transfer subject to Chapter V GDPR and is not covered by an adequacy decision, it requires an applicable safeguard, such as Standard Contractual Clauses together with any necessary supplementary measures, or a narrowly applicable statutory derogation. An order, a general cookie consent or the publication of this policy does not itself provide that safeguard. The contractual derogation in Art. 49(1)(b) GDPR is not a general basis for routine fulfilment transfers.
Authorities in third countries may have access powers and available remedies may differ from those in the EEA. You may contact legal@yunelle.com or our EU contact to request information about the recipients and transfer arrangements relevant to your data, including a copy of an applicable safeguard.
15. Storage periods and criteria
Order, invoice and accounting records are retained according to the statutory rules applicable to the particular record and entity. Hong Kong business records within section 51C of the Inland Revenue Ordinance must generally be kept for at least seven years. Where German commercial or tax retention rules apply, the usual periods distinguish ten years for books and annual accounts, eight years for accounting vouchers and invoices, and six years for business correspondence. These periods do not apply indiscriminately to all customer data. The statutory start date and any required extensions depend on the applicable rule, including pending tax or legal proceedings.
Customer-account data is retained while the account is active. When an account is deleted, records still needed for orders, statutory retention or legal claims are retained only for those purposes.
Customer-service and withdrawal records are kept while the matter is being handled and for any applicable retention or claims period. Server log files are erased or anonymised no later than seven days after collection.
Newsletter contact data is used for marketing until you unsubscribe. We may retain a suppression record to respect your choice and evidence of consent for the applicable claims period. Withdrawal of consent stops future processing based on that consent; existing data is erased when no other lawful retention ground applies.
Analytics and marketing data is retained for the relevant analysis or attribution purpose and the configured provider retention period. Cookies and similar identifiers used by analytics and marketing services have a lifetime of up to 24 months, depending on the provider. Typical lifetimes are up to 24 months for Google Analytics, up to 90 days for Google Ads, up to 90 days for Meta and up to 13 months for TikTok. You can view the exact purposes and lifetimes of cookies in use and manage your choices in our cookie settings.
Records of consent are retained for the period needed to demonstrate compliance and address related legal claims. Once the relevant purposes and retention grounds expire, personal data is erased or anonymised.
16. Your rights
You have the following rights with regard to your personal data:
Access pursuant to Art. 15 GDPR. You may request information as to whether and which data we process about you, for what purposes, to which recipients and for how long.
Rectification pursuant to Art. 16 GDPR. You may request the rectification of inaccurate data and the completion of incomplete data.
Erasure pursuant to Art. 17 GDPR. You may request the erasure of your data, provided that no statutory retention obligation or other exception applies.
Restriction of processing pursuant to Art. 18 GDPR.
Data portability pursuant to Art. 20 GDPR. You may request to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
Withdrawal of consent pursuant to Art. 7 (3) GDPR. You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected.
An informal message to legal@yunelle.com is sufficient to exercise your rights.
Right to object pursuant to Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6 (1) (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
Where your data is processed for direct marketing purposes, you have the right to object to such processing at any time and without giving reasons. Following such an objection, we will no longer process your data for direct marketing purposes.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
You do not have to complain to a particular authority selected by us. For matters under Hong Kong law, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.
17. Automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 (1) and (4) GDPR that produces legal effects concerning you or similarly significantly affects you does not take place. Where payment service providers carry out their own checks as part of payment processing, they do so on their own responsibility.
18. Necessity of providing data
Providing your personal data is neither required by law nor by contract. However, certain information is necessary in order to conclude a purchase contract, in particular your name, delivery address and e-mail address. Without this information we cannot conclude or perform the contract.
19. Data security
We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular encryption of data transmission, access restrictions and the careful selection of our service providers. We continuously adapt our measures to technical developments.
20. Changes to this privacy policy
We update this privacy policy whenever the legal situation, our services or the nature of our data processing changes. The version available on this page applies.
Your cookies, your decision
We use cookies to optimize the functionality of the website, analyze performance and provide you with a personalized experience. A few of them are essential, and we'll leave the rest up to you to decide.
Absolutely essential
Without these cookies, our site will not function properly. That's why you can't deselect them. Sorry.
Performance cookies:
We use performance cookies to analyze visits, identify traffic sources and recognize which areas of our website are particularly popular. This is how we make your shopping experience even more enjoyable.
Functional cookie:
Functional cookies almost explain what they are good for with their name: They improve functionality and personalization on our website. We or third-party providers can set them. If you disable them, third-party services may not work properly.
Targeting Cookies:
A cookie here, good advertising there. It's as simple as that with targeting cookies. Our advertising partners place them on our website to better understand you and your interests. This way, you will see really relevant advertising on other websites. They do not store any direct personal data, but are based on the unique identification of your browser and internet device.
Save
