Privacy policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
E&G Commerce GmbH
Colbestraße 13
10247 Berlin
Germany
Managing Director: Snezhana Stoeva
Email: info@levans-shop.de
We are not legally required to appoint a data protection officer and have not currently appointed anyone to this role.
2. General Information on Data Processing
When you visit our online shop, our hosting service provider Shopify automatically processes technical information transmitted by your browser (known as server log data). This includes, in particular, your IP address, the date and time of the request, browser type and version, the operating system used and the previously visited page. This data is technically necessary to deliver the website to you and to ensure system security. The legal basis is our legitimate interest in the secure and functional operation of the shop (Article 6(1)(f) GDPR).
3. Hosting by Shopify
Our online shop is operated on Shopify’s technical infrastructure:
Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify processes personal data generated through the use of our shop on our behalf as a processor. Further information about data processing by Shopify can be found in Shopify’s Privacy Policy: https://www.shopify.com/legal/privacy
4. Cookies and Consent Management
Our shop uses cookies. When you first visit our shop, we inform you about cookies through a cookie banner and give you the option to consent to or reject the use of non-essential cookies. Technically necessary cookies that are required to operate the shop (for example, for the shopping cart or checkout) are set on the basis of our legitimate interest (Article 6(1)(f) GDPR). All other cookies are used only with your consent (Article 6(1)(a) GDPR).
You can change your cookie settings or withdraw your consent at any time using the “Cookie settings” link in the footer of our website.
5. Orders and Contract Processing
When you place an order with us, we collect and process the data required to perform the contract (for example, your name, address, email address, order details and payment data). The legal basis is the performance of the purchase contract concluded with you or taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
6. Customer Accounts and Guest Orders
You may place an order with us either using a customer account or as a guest. When you create a customer account, we store the information you provide so that you do not have to enter it again for future orders. The legal basis is Article 6(1)(b) GDPR and, where you voluntarily create an account, Article 6(1)(a) GDPR.
7. Contacting Us
If you contact us by email or through a contact form, we process the data you provide in order to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contractual or pre-contractual matter; otherwise, it is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).
8. Newsletter
If you subscribe to our newsletter through Shopify Messaging, we use a double opt-in procedure: after subscribing, you will receive an email asking you to confirm your subscription. You will receive our newsletter only after this confirmation. The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link in each newsletter email.
9. Shopify Messaging
We use the “Shopify Messaging” feature to send our newsletter. At present, only the email channel is active; we do not use SMS marketing.
10. Shopify Claude Connector App
We use the “Shopify Claude Connector App” to design and continuously improve our online shop. As part of its functions, this app may access the following data:
Customer data: name, email address, telephone number, physical address, geolocation, IP address, browser and operating system information.
Data relating to the shop owner and contributors: name, email address, telephone number and physical address (shop owner); email address, IP address, browser and operating system information (blog contributors).
The legal basis is our legitimate interest in the efficient design, maintenance and further development of our online shop (Article 6(1)(f) GDPR). Further information about data processing can be found in Shopify’s Privacy Policy: https://www.shopify.com/legal/privacy
11. Withdrawal Function (Revoq)
To provide the legally required electronic withdrawal function, we use the “Revoq – EU Withdrawal Button” app. In connection with a withdrawal, Revoq processes customer, order, device and activity data. We have entered into a data processing agreement with the provider of Revoq in accordance with Article 28 GDPR. The legal basis is compliance with our legal obligations in connection with the right of withdrawal (Article 6(1)(c) GDPR).
12. Payment Service Providers
Depending on the payment method you select at checkout, we transmit the payment data required for the transaction to the relevant payment service provider. The following payment methods are active in our shop: Shopify Payments, Shop Pay, PayPal, Klarna, Apple Pay, Google Pay and the card networks Visa, Mastercard, American Express, Maestro and UnionPay, where displayed as a payment method at checkout. These providers may process personal data as independent controllers, particularly for payment processing and fraud prevention. For further information, please refer to the respective providers’ privacy notices. The legal basis is the performance of the contract (Article 6(1)(b) GDPR).
13. Fraud Prevention
To prevent fraudulent orders and payments, we use the fraud prevention mechanisms integrated into Shopify and the payment service providers involved. The legal basis is our legitimate interest in preventing payment defaults and fraud (Article 6(1)(f) GDPR).
14. Shipping Service Providers
To deliver your order, we transmit the necessary data (name, delivery address and, where applicable, contact details) to a suitable shipping service provider. The legal basis is the performance of the contract (Article 6(1)(b) GDPR).
15. Returns, Complaints and Withdrawals
In the event of a return, complaint or withdrawal, we process the data required for this purpose (for example, order details, contact details and your message) in order to handle your request. The legal basis is Article 6(1)(b) GDPR and, where legal obligations are concerned, Article 6(1)(c) GDPR.
16. Google Workspace
We use Google Workspace for our email communications. Personal data that you provide to us by email may be processed on Google servers. The legal basis is our legitimate interest in reliable email communication (Article 6(1)(f) GDPR) or the performance of the contract where the communication relates to an order.
17. Locally Hosted Fonts
Our shop uses locally hosted fonts (theme fonts). No connection is made to external font services (for example, Google Fonts), so no data is transmitted to external providers in this respect when our pages load.
18. Social Media Links
Our website contains links to our profiles on Instagram and TikTok. These are simple external links and not embedded plugins. The relevant provider processes your data in accordance with its own privacy policy only when you actively click such a link and visit the respective platform.
19. International Data Transfers
Some of the service providers mentioned above (for example, Google, PayPal and Apple) may also process data in countries outside the EU/EEA, particularly in the United States. In such cases, we ensure that data is transferred only where an adequacy decision by the European Commission applies to the relevant country or recipient, or where appropriate safeguards have been agreed, in particular the European Commission’s Standard Contractual Clauses. Further information is available upon request and in the respective providers’ privacy notices.
20. Recipients of Your Data
Depending on the circumstances, recipients of your data are the service providers named in this Privacy Policy (including Shopify, payment service providers, shipping service providers, Revoq and Google), insofar as this is necessary to provide our services.
21. Retention Period
We store personal data only for as long as is necessary for the relevant purposes or as required by statutory retention obligations. In particular, data relating to orders and invoices is subject to commercial and tax retention periods (including Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)), generally of six or ten years.
22. Your Rights
You have the right to:
access the personal data we process about you (Article 15 GDPR),
rectification of inaccurate data (Article 16 GDPR),
erasure of your data (Article 17 GDPR),
restriction of processing (Article 18 GDPR),
data portability (Article 20 GDPR),
withdraw consent with effect for the future (Article 7(3) GDPR).
23. Right to Object
Where we process your data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Article 21 GDPR). You may object to the processing of your data for direct marketing purposes at any time without giving reasons.
24. Automated Decision-Making
We do not carry out decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
25. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
26. Changes to This Privacy Policy
We will update this Privacy Policy whenever the processes, services or functions we actually use change. The version current at the time of your visit applies.
Last updated: August 2026