Ombre & Feu Fragrance

Privacy policy

This translation is provided for convenience only. The German version is legally binding.

Last updated: 25 September 2026

The protection of your personal data is important to us. In this privacy policy you will learn which personal data we process when you use our online shop ombrefeu.de, our loyalty program “VIP Club” or our iPhone app “Ombre & Feu”, for what purposes this is done and what rights you have.

1. Controller

Firat Tarti – Ombre & Feu Fragrance (sole proprietorship)
Welper Str. 13A
49377 Vechta
Germany
Phone: 0173 3000986
Email: info@ombrefeu.de

A data protection officer is not required by law and has therefore not been appointed. If you have any questions about data protection, please use the contact details above.

2. Principles and legal bases

We only process personal data where there is a legal basis for doing so. These are in particular:

  • Art. 6(1)(a) GDPR – your consent (e.g. newsletter, marketing cookies, push notifications). You can withdraw your consent at any time with effect for the future.
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. order, customer account, VIP Club).
  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention obligations under commercial and tax law).
  • Art. 6(1)(f) GDPR – legitimate interests (e.g. secure and stable operation, fraud prevention, direct marketing to existing customers).
  • Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) – consent to storing and accessing information on your device, unless this is strictly technically necessary (Section 25(2) TDDDG).

3. Hosting and shop system (Shopify)

Our online shop is operated on the Shopify platform. The provider for users in Europe is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes on our behalf all data generated when visiting the shop, placing orders and using the customer account (Art. 28 GDPR). Data may also be transferred to Shopify Inc. in Canada and to sub-processors in the USA (see Section 17). Further information: Shopify privacy policy.

Where Shopify uses data for its own purposes (e.g. for the Shop app or Shop Pay), Shopify is itself the controller for this. You can exercise your rights against Shopify via the Shopify privacy portal.

4. Accessing the website and server log files

When you access our website, technical data transmitted by your browser is processed automatically: IP address, date and time, page accessed, referrer URL, browser type and operating system. This data is required to deliver the website and ensure its security (Art. 6(1)(f) GDPR). The connection is encrypted via TLS/SSL.

5. Cookies and consent management

We use cookies and similar technologies. We set technically necessary cookies (e.g. for the cart, checkout, login and storing your cookie settings) on the basis of Section 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. All other cookies – in particular for statistics and marketing – are only set with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your selection at any time via the cookie settings of our shop.

6. Orders and customer account

To process your order, we process your name, billing and delivery address, email address, telephone number if applicable, ordered items, payment information and order history (Art. 6(1)(b) GDPR). If you create a customer account, we additionally store this data in your account so that you can view your orders. You can request the deletion of your customer account at any time by email to info@ombrefeu.de.

Due to requirements under commercial and tax law (Section 257 HGB, Section 147 AO), we retain invoices and accounting records for up to 10 years (Art. 6(1)(c) GDPR). Processing is restricted for this period.

7. Payment service providers

Payment is processed via the payment service provider you have chosen. For this purpose, we transmit the data required for payment (Art. 6(1)(b) GDPR). Payment data such as card numbers are not stored by us.

  • Shopify Payments (credit/debit card, Apple Pay, Google Pay) – Shopify International Limited, Ireland, with the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland.
  • Shop Pay – Shopify International Limited, Ireland.
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. To enable PayPal to provide buyer protection, we transmit the tracking number and shipping provider to PayPal after dispatch (Art. 6(1)(b) and (f) GDPR); for this we use the app “Synctrack PayPal Tracking”.
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For purchases on invoice or in instalments, Klarna may carry out an identity and credit check; details can be found in Klarna’s privacy policy.

8. Shipping

For delivery, we pass on your name, delivery address and – where required for delivery notifications – email address or telephone number to the commissioned shipping company (Art. 6(1)(b) GDPR).

9. Accounting

For our accounting, we transfer order and invoice data to Lexware Office (Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany) via the “Lexware Office” interface by Eshop Guide (Art. 6(1)(c) and (f) GDPR).

10. Newsletter and email marketing (Klaviyo, Shopify)

If you subscribe to our newsletter, we will send you information about products, promotions and news. Subscription takes place using the double opt-in procedure: you receive an email in which you confirm your subscription. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email.

For sending, we use Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA) and Shopify Messaging. Email address, name, time of subscription, IP address and – if you are a customer – purchase information are processed. We analyse whether newsletters are opened and links are clicked in order to improve our content. If you have ordered from us, we may also send you information about similar products of our own by email without separate consent (Section 7(3) UWG); you can object to this at any time without incurring any costs other than the transmission costs according to the basic rates.

11. Contact forms and enquiries

If you contact us by email, telephone or via a form (Shopify Forms), we process your details in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data as soon as it is no longer required and no retention obligations apply.

12. VIP Club (loyalty program)

With a customer account, you can take part in our VIP Club and collect and redeem points. For this purpose, we process your customer ID, name, email address, points balance, membership tier, purchases, redeemed vouchers, completed tasks (e.g. newsletter subscription or following our social media channels), referrals and – voluntarily – your date of birth for the birthday bonus (Art. 6(1)(b) GDPR). For following us on social media, we do not check any data with the platforms; the points are credited on a trust basis.

The loyalty program is operated with our own Shopify app “VIP Atelier”. The data is stored with Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor. Optionally, you can save a digital membership card in Apple Wallet or Google Wallet; your name, membership tier and points balance are transferred to the card. You can leave at any time by email; your VIP data will then be deleted.

13. Reviews (Trustpilot)

We use Trustpilot (Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark) to display reviews and, where applicable, to invite you to leave a review after an order. For an invitation, we transmit your name, email address and order number to Trustpilot (Art. 6(1)(f) GDPR – our interest in genuine, verifiable customer reviews). You can object to this at any time. Whether you leave a review is voluntary.

14. Instagram feed

On our homepage, we show current posts from our Instagram channel via the app “Instafeed” (Mintt Studio). When the feed is loaded, images are retrieved from servers of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland; for technical reasons, your IP address is transmitted in the process. The legal basis is our legitimate interest in an appealing presentation of our offering (Art. 6(1)(f) GDPR).

15. Marketing and analytics pixels (only with consent)

We connect our shop with the sales channels of Google, Meta (Facebook & Instagram), TikTok and Pinterest. Via these channels, we provide our product catalogue (without personal data). Only if you have given your consent in the cookie banner will pixels or tags of these providers be loaded, which measure your activities in the shop (e.g. page views, cart, purchase) in order to determine the effectiveness of our advertising and to show you relevant advertising (Art. 6(1)(a) GDPR, Section 25(1) TDDDG):

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google & YouTube)
  • Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (Facebook & Instagram)
  • TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland
  • Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland

These providers may also transfer data to the USA or other third countries (see Section 17). For data processed on their platforms, the providers are in some cases joint controllers with us (Art. 26 GDPR) or sole controllers. You can withdraw your consent at any time via the cookie settings.

16. Influencer collaborations (Shopify Collabs)

For collaborations with creators, we use Shopify Collabs. If you order via a creator’s referral link or discount code, the order is attributed to the creator so that they receive their commission. The creator does not receive any personal data about you. Where cookies are used for this, this is only done with your consent.

17. Transfers to third countries

Some of the service providers mentioned also process data outside the EU or the EEA, in particular in the USA and Canada. For Canada, there is an adequacy decision of the EU Commission. For the USA, transfers to companies certified under the EU-US Data Privacy Framework are based on the adequacy decision of 10 July 2023 (Art. 45 GDPR); otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

18. Our iPhone app “Ombre & Feu”

The following additionally applies to the use of our app:

  • No tracking: The app contains no advertising or analytics SDKs, does not read out any advertising ID (IDFA) and does not track you across apps or websites of other providers.
  • Download via the App Store: When you download the app, Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) processes data such as your Apple ID as an independent controller. We have no influence on this.
  • Shop and cart: Products, journal posts and your cart are loaded directly via the Shopify interface (see Section 3). The identifier of your cart is stored encrypted in the iOS keychain of your device so that your cart is preserved.
  • Checkout and VIP account: Checkout and the VIP account open in a browser window within the app showing the pages of our shop. Sections 5 to 7 and 12 apply. Login data is not stored by the app.
  • Push notifications: Only if you allow notifications in iOS do we store a push token of your device and a randomly generated device ID on our server at Cloudflare, Inc. (USA). The notifications (e.g. release, new posts, promotions) are delivered via the push service of Expo (650 Industries, Inc., Palo Alto, California, USA) and the Apple Push Notification Service. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can deactivate notifications at any time in the iOS settings; we automatically delete push tokens that are no longer valid.
  • Reminders: The launch reminder and the refill reminder after an order are scheduled exclusively locally on your device. No data is transmitted to us in the process.
  • Community polls: Your vote is stored together with the randomly generated device ID so that each device can only vote once. This ID is not linked to your name or customer account (Art. 6(1)(f) GDPR).
  • Sharing and rating: The story card of the fragrance finder is created locally on your device and only shared if you trigger this yourself via the iOS share menu. To ask for an app rating, we use Apple’s function; we do not learn who submits a rating.
  • Server access: When the community feed is retrieved, technically necessary data (e.g. IP address) is processed by Cloudflare in order to answer the request and fend off attacks (Art. 6(1)(f) GDPR).
  • Deletion: If you delete the app, all locally stored data is removed. You can request the deletion of your push token, your votes or your customer account at any time by email to info@ombrefeu.de or via “Profile › Delete account” in the app.

19. Links to social networks

In the shop and the app, we link to our profiles on Instagram, TikTok and Facebook. These are simple links; data is only transmitted when you click a link and visit the respective platform. The privacy policy of the respective provider applies there.

20. Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods apply. We delete consent-based data after you withdraw your consent, unless another legal basis applies.

21. Your rights

As a data subject, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to withdraw consent given at any time with effect for the future (Art. 7(3) GDPR). To do so, simply contact info@ombrefeu.de.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

22. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Any credit check by Klarna is carried out under Klarna’s own responsibility.

23. Changes

We will adapt this privacy policy if our services or the legal situation change. The version published here at any given time applies.