Privacy policy
Last updated: 10 October 2026
1. Controller and contact details
The controller responsible for processing personal data in connection with this online shop is:
EDELFUNDE EOOD
zh.k. Manastirski livadi B, bl. 48, et. 2, ap. 3
1404 Sofia, Bulgaria
Email: kontakt@edelfunde.de
Telephone: +359 89 861 0078
This Privacy Policy explains which personal data we process when you visit our online shop, place orders or communicate with us, the purposes of that processing and your rights.
Using our website does not constitute consent to any processing that requires consent. Where consent is required, we obtain it separately.
2. The data we process
Depending on how you use our online shop and its features, we process in particular:
- Contact and address data: your name, billing and delivery addresses, email address and, where applicable, telephone number.
- Order and transaction data: products ordered, cart contents, order value, payment status, shipping information, returns and refunds.
- Payment data: details of your chosen payment method and the information required to process the payment. Sensitive payment information is processed in particular by the payment service providers involved.
- Customer account data: if you use a customer account, the details, settings and order information required for it.
- Communication data: the contents of your enquiries and our correspondence.
- Technical and usage data: in particular your IP address, browser and device information, access times, pages viewed and interactions with our online shop.
- Consent and marketing data: your privacy choices, consents given and, where applicable, interactions with marketing messages or advertisements.
We receive these data from you, through your use of our online shop and, where necessary and legally permitted, from service providers such as payment and shipping providers.
3. Purposes and legal bases
Orders and performance of contracts
We process your data to receive orders, process payments, ship goods, inform you about your order and handle returns, refunds and contract-related enquiries.
The legal basis is Article 6(1)(b) GDPR.
Customer account
If you use a customer account, we process your data to provide and manage that account and its associated features.
The legal basis is Article 6(1)(b) GDPR.
Contacting us
For contract-related enquiries, processing is based on Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to respond appropriately to enquiries and communicate with prospective customers and customers.
Security and enforcement of rights
We process the necessary data to ensure the secure operation of our online shop, resolve technical problems, prevent or investigate misuse and fraud, and establish or defend legal claims.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to protect our online shop, our customers and our economic and legal interests. We take account of your interests and fundamental rights.
Legal obligations
Where we process data to comply with legal obligations, in particular tax and accounting obligations, the legal basis is Article 6(1)(c) GDPR.
Processing based on consent
Where we obtain your consent, in particular for certain analytics and marketing measures, processing is based on Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.
We need the information required for an order to perform the contract. Without it, we may be unable to process the order. Consent to advertising or non-essential tracking technologies is voluntary and is not a condition of making a purchase.
4. Shopify as our shop platform
Our online shop runs on Shopify. Shopify provides the technical infrastructure and features we use to operate the shop, manage orders and provide our services.
In doing so, Shopify processes in particular contact, order, transaction, device and usage data. Where Shopify processes data on our behalf, this is based on a data processing agreement.
For certain additional features, Shopify may also act as an independent controller. These include in particular enhanced services that use information from interactions with our shop, other merchants and Shopify, for example to improve services and personalise advertising. This applies in particular to Shopify Network Intelligence, where that feature is enabled in our shop.
Where consent is required, the relevant processing takes place only on the basis of that consent. You can manage your choices through the cookie settings.
Information about processing by Shopify and your rights in relation to Shopify is available here:
Shopify Consumer Privacy Policy
5. Payment processing
Shopify Payments
We offer payments through Shopify Payments. This service is provided to our business by Shopify International Limited, Ireland.
To process a payment, the necessary payment, billing and transaction data are transmitted to Shopify and the payment service providers and financial institutions involved in the chosen payment method. The data required depend on the payment method selected.
The transmission for payment processing is based on Article 6(1)(b) GDPR. Where we are subject to legal obligations, processing is based on Article 6(1)(c) GDPR. Necessary and permissible fraud prevention measures are based on Article 6(1)(f) GDPR.
Further information:
PayPal
If you select PayPal as your payment method, we transmit the order, contact and transaction data required for payment processing to PayPal. For customers in the European Economic Area, the service is generally provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
The transmission for processing your payment is based on Article 6(1)(b) GDPR.
PayPal also processes data as an independent controller, in particular to provide its payment services, prevent fraud and comply with legal obligations. Depending on the PayPal payment product selected, further checks may be required. Details of this processing and your rights are set out in PayPal's Privacy Policy:
6. Shipping and other recipients
To deliver your order, we share the necessary data with the transport and logistics providers responsible for shipping. These include in particular your name and delivery address and, where required for delivery, further contact details.
The legal basis is Article 6(1)(b) GDPR. Any further sharing for optional notifications takes place only with your consent where required.
In addition, necessary data may be transmitted to the following categories of recipients:
- technical service providers for hosting, maintenance, IT security and customer communications;
- payment service providers and financial institutions;
- providers of accounting, tax and legal advisory services;
- analytics and marketing service providers, where the relevant legal requirements are met;
- public authorities or other entitled bodies where there is a legal obligation.
Service providers receive only the data necessary for their respective tasks. Where they process data on our behalf, they are bound by contractual obligations in accordance with legal requirements.
Electronic withdrawal feature (EU Widerruf Button)
We provide an online withdrawal form on our website to allow you to exercise your right of withdrawal electronically. For this purpose, we use the “EU Widerruf Button” application provided by 401layers UG (haftungsbeschränkt).
When you use the form, we process the data you enter, in particular your name, email address, order number and, where applicable, details of the items concerned and the content of your withdrawal notice. Technically necessary connection data may also be processed.
Processing is carried out to receive, document and handle your withdrawal notice and send you an electronic acknowledgement of receipt.
The legal bases are Article 6(1)(b) GDPR for handling the contractual relationship and Article 6(1)(c) GDPR where processing is necessary to comply with legal obligations.
The provider processes the data required to operate the withdrawal feature on our behalf under a data processing agreement in accordance with Article 28 GDPR.
In the service used, withdrawal requests are automatically deleted after the currently configured retention period of six months. Necessary documents are retained for longer in our own systems only where required to comply with legal obligations or safeguard legitimate legal interests.
The electronic withdrawal feature is available at the following link:
https://edelfunde.de/en/pages/widerruf-formular
7. Cookies and similar technologies
Our online shop uses cookies and similar technologies.
Technically necessary technologies serve, for example, cart functionality, security, login and storage of your privacy choices. Where storing information on your device or accessing it is strictly necessary to provide a service you have expressly requested, this takes place under Section 25(2), point 2 TDDDG, where applicable. Subsequent processing of personal data is based, depending on the purpose, on Article 6(1)(b), (c) or (f) GDPR.
Non-essential technologies, in particular for analytics, audience measurement and personalised advertising, are used only with your consent where legally required. The legal bases in this respect are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Information about the consent-based services used, their providers, purposes and durations is provided within the consent settings or in the information linked there.
You can reject non-essential technologies and change your choices at any time through the cookie settings on our website. Rejecting them does not prevent you from making a purchase.
8. Advertising, newsletters and performance measurement
We use marketing measures to draw attention to our products and assess the effectiveness of our advertising. These may include in particular search engine advertising, advertising on social networks, newsletters, other direct marketing and affiliate marketing.
We distinguish between simply placing advertisements and processing personal data for personalisation or performance measurement.
Newsletters and electronic advertising
We send promotional emails and other electronic advertising messages with your prior consent, unless a legally permitted exception applies. Where consent is given, the legal basis is Article 6(1)(a) GDPR.
Where we send existing customers advertising for our own similar products under the applicable legal conditions, data processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide information about relevant offers of our own. You will be informed of your right to object when your contact details are collected and in each relevant message.
You can unsubscribe from advertising messages at any time using the unsubscribe link in them or by contacting us. Necessary communications about your orders are unaffected.
Personalised advertising and analytics
Where relevant services are used and you have consented, usage, device and transaction data may be processed to infer interests, display relevant advertisements and measure the success of marketing measures. Cookies, pixels or similar technologies may be used for this purpose.
Advertising partners involved may combine information with data you have provided to them yourself or that have been collected through your use of their services. Before giving consent, you will receive details of the services used in the relevant privacy and consent information.
We also use consent-based methods to measure opens or clicks in advertising messages only with the required consent.
Affiliate marketing
Where we work with referral or advertising partners, referrals and resulting orders may be attributed for commission accounting. If non-essential cookies or similar tracking technologies are used for this purpose, we obtain your consent in advance. Subsequent processing for necessary accounting and misuse prevention may be based on Article 6(1)(f) GDPR; our legitimate interest is accurate accounting.
Objection to direct marketing
You may object at any time to the processing of your personal data for direct marketing. This also applies to profiling to the extent that it is related to such direct marketing. We will then no longer process your data for these purposes.
9. Links to external websites
Our online shop may contain links to external websites, marketplaces or social networks. If you follow such a link, the provider of the destination website is responsible for processing your data there.
Further information is available in that provider's privacy notices. A simple external link is distinct from embedded content or tracking technologies, which may require consent already on our website.
10. International data transfers
When using Shopify and other service providers, personal data may also be processed outside the European Economic Area.
Where such a transfer takes place, we ensure that the legal requirements are met. These include in particular European Commission adequacy decisions or appropriate safeguards, such as EU Standard Contractual Clauses and, where necessary, supplementary protective measures.
You can request information about the safeguards applicable to a specific transfer and a copy of the relevant safeguards using the contact details above. Confidential information will be protected where necessary.
11. Retention periods
We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations.
The following criteria apply in particular:
Order, payment and accounting records: for performance of the contract and subsequently for the applicable statutory retention periods, in particular under the Bulgarian tax and accounting law applicable to our business.
Customer account data: for the duration of the customer account; after its deletion, only where legal obligations or other permissible grounds for retention exist.
Contact enquiries: until they have been fully dealt with and, where applicable, beyond that where the correspondence is needed for contractual obligations or legal claims.
Marketing data: until you withdraw your consent, object or the purpose of processing ceases to apply. Necessary evidence of consents and unsubscribing may be retained beyond that to fulfil our obligations to demonstrate and respect your choices.
Technical logs: only for as long as necessary to ensure operation and investigate security incidents.
Cookies and similar technologies: in accordance with the durations stated in the relevant consent information or until earlier deletion.
Where data must be retained for longer due to legal obligations or for the establishment, exercise or defence of legal claims, we restrict processing to those purposes.
12. Your rights
Subject to the relevant legal conditions, you have in particular the following rights:
- Access to your personal data under Article 15 GDPR;
- Rectification of inaccurate data and completion of incomplete data under Article 16 GDPR;
- Erasure of your data under Article 17 GDPR;
- Restriction of processing under Article 18 GDPR;
- Data portability under Article 20 GDPR;
- Objection to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation, under Article 21 GDPR;
- Objection at any time to direct marketing, including related profiling;
- Withdrawal of consent with effect for the future, without affecting the lawfulness of processing carried out before withdrawal.
Where decisions are based solely on automated processing and produce legal effects concerning you or similarly significantly affect you, you also have the safeguards provided by Article 22 GDPR. A personalised product recommendation or advertisement alone generally does not constitute such a decision.
To exercise your rights, you can contact us at kontakt@edelfunde.de. Where necessary, we will ask for appropriate information to verify your identity.
We generally respond to requests within one month of receipt. Where an extension is legally permitted, we will inform you within that period of the extension and the reasons for it.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement. You do not need to contact us first.
For our business in Bulgaria, the following authority is particularly relevant:
Комисия за защита на личните данни (КЗЛД)
Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria
Website: https://cpdp.bg
Email: kzld@cpdp.bg
14. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and unlawful disclosure. These measures are adapted in light of the risks and technological developments.
15. Changes to this Privacy Policy
We update this Privacy Policy where changes in our data processing or legal requirements make this necessary.
The current version is available on this website. We will additionally inform you of material changes where legally required. Where new processing requires your consent, we obtain it separately.