1. Data Controller

The data controller responsible for the processing of personal data on this website is:

Y. Borhani GmbH
Brook 7
20457 Hamburg
Germany

Email: sales@teppique.com

Below, we inform you about what personal data is processed when you visit our online shop and use our offers.

2. General information on data processing

Personal data is any information that can directly or indirectly identify a person. This includes, for example, name, address, email address, telephone number, IP address, order data, and payment information.

We only process personal data if there is a legal basis for doing so. Processing is carried out in particular:

– to fulfill a contract or take steps before or in connection with a contract pursuant to Art. 6(1)(b) GDPR,
– to comply with legal obligations pursuant to Art. 6(1)(c) GDPR,
– for our legitimate interests pursuant to Art. 6(1)(f) GDPR, or
– on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

3. Hosting and Shopify store system

Our online shop is operated via the Shopify platform. The provider is:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides us with the technical infrastructure for operating the online shop. When you visit and use our shop, your IP address, device and browser information, usage data, contact information, order data, as well as payment and transaction information may be processed via Shopify's systems.

Processing is carried out to provide and secure the online shop, process orders, and fulfill our contractual obligations pursuant to Art. 6(1)(b) and (f) GDPR.

As part of the use of Shopify, data may also be transferred to affiliated companies and service providers outside the European Economic Area. According to Shopify, appropriate data protection safeguards are used for this purpose, in particular adequacy decisions and standard contractual clauses of the European Commission.

Further information can be found in Shopify's privacy policy:

https://www.shopify.com/legal/privacy

4. Server log data

When you access our website, technical information is automatically processed. This may include:

– IP address,
– date and time of access,
– pages and files accessed,
– previously visited website,
– browser type and version,
– operating system,
– device information, and
– amount of data transmitted.

This processing is necessary to technically provide the website, ensure its stability and security, and detect unauthorized access.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of our online shop.

5. Orders and customer account

If you place an order or create a customer account in our online shop, we process the data you provide. This includes, in particular:

– first and last name,
– billing and delivery address,
– email address,
– telephone number, if provided,
– ordered products,
– order and transaction information,
– payment method and payment status, as well as
– details regarding returns, cancellations, or complaints, if applicable.

The data is used to process your order, deliver the goods, handle payment, provide customer support, and fulfill legal retention obligations.

The legal bases are Art. 6(1)(b) and (c) GDPR.

To the extent necessary for contract fulfillment, we transfer the required data to shipping service providers, payment service providers, tax advisors, and other service providers involved in order processing.

6. Payment processing

6.1 PayPal

If you select PayPal as a payment method, the data required for payment processing is transferred to PayPal.

The provider for customers within the European Economic Area is generally:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

The transferred data may include your name, address, email address, order amount, currency, order data, IP address, and other information required for payment processing.

Processing is carried out to fulfill the contract pursuant to Art. 6(1)(b) GDPR. PayPal may also process data for fraud prevention, identity verification, and compliance with legal obligations on its own responsibility.

Further information can be found in PayPal's privacy policy:

https://www.paypal.com/de/legalhub/paypal/privacy-full

6.2 Shopify Payments and other payment methods

If other electronic payment methods are offered at checkout and you select one of them, the information required for payment processing is processed via Shopify or the respective payment service provider displayed.

The specific payment methods available will be displayed to you at checkout before completing the order. This may include the processing of your name, billing address, order amount, currency, payment information, IP address, and transaction data.

Processing is carried out to fulfill the contract pursuant to Art. 6(1)(b) GDPR.

6.3 Prepayment and bank transfer

If you choose prepayment or bank transfer as a payment method, we process the data transmitted as part of the transfer. This may include your name, account information, purpose of payment, invoice amount, and transaction data.

Processing is carried out to fulfill your order pursuant to Art. 6(1)(b) GDPR.

7. Shipping and delivery

To deliver your order, we transfer the required data to the appointed shipping service provider. This may include your name, delivery address, email address, telephone number, and order information.

The transfer is carried out only to the extent necessary for delivery or shipping notification.

The legal basis is Art. 6(1)(b) GDPR.

8. Contact

If you contact us by email, contact form, or telephone, we process the information you provide to handle your request. This may include your name, email address, telephone number, the content of the message, and other voluntarily provided information.

If your request relates to an order or a potential contract, processing is carried out pursuant to Art. 6(1)(b) GDPR. For other requests, processing is based on our legitimate interest in communicating appropriately pursuant to Art. 6(1)(f) GDPR.

9. Newsletter and marketing communications

If you subscribe to our newsletter, we process your email address to send you information about our products, offers, and news.

Processing is carried out only on the basis of your consent pursuant to Art. 6(1)(a) GDPR. If a confirmation process is used, we also store the time and technical information of the registration so that we can prove your consent.

You can revoke your consent at any time with effect for the future. To do so, use the unsubscribe link at the end of every newsletter email or contact us at sales@teppique.com.

The lawfulness of the processing carried out until revocation remains unaffected.

10. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small files that can be stored on or read from your device.

Technically necessary cookies are required to provide basic online shop functions. These include, in particular, the shopping cart, checkout, language settings, security functions, login functions, and the storage of your privacy settings.

Technically necessary cookies are processed to provide the expressly requested service and, where personal data is processed, pursuant to Art. 6(1)(b) or (f) GDPR.

Non-essential cookies and similar technologies, in particular for statistics, analysis, and advertising, are only used with your prior consent. The legal basis is Art. 6(1)(a) GDPR.

You can change your selection at any time via the privacy settings or the cookie banner on our website, or revoke a given consent.

11. Google Analytics

We use Google Analytics to statistically evaluate the use of our online shop. The provider within the European Economic Area is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics may process information about your use of the website. This includes, in particular:

– pages accessed,
– source of the visit,
– approximate location information,
– device and browser information,
– interactions with the website,
– order and conversion events,
– cookie and device identifiers, as well as
– truncated or otherwise processed IP addresses.

Google Analytics is only used if you have consented to the use of analytics technologies via the cookie banner.

The legal basis is Art. 6(1)(a) GDPR. You can revoke your consent at any time via the privacy settings on our website.

As part of the use of Google services, data may also be transferred to Google LLC and other affiliated companies in third countries, in particular the USA. According to Google, such transfers are based on applicable adequacy decisions and appropriate safeguards such as standard contractual clauses.

Further information can be found at:

https://policies.google.com/privacy?hl=de

12. Google & YouTube, Google Ads, and conversion measurement

We use the Shopify integration "Google & YouTube" to make our products available via Google services and to measure the success of our advertising and sales measures.

Google tags and similar technologies may be used for this purpose. Depending on your consent and the respective configuration, the following information may be processed in particular:

– pages visited and products viewed,
– search queries and interactions,
– cart and purchase events,
– order value and currency,
– device and browser information,
– IP address,
– cookie and advertising identifiers, as well as
– information about the attribution of a purchase to an ad.

The provider within the European Economic Area is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Processing for analysis and advertising purposes is carried out only with your consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time via the privacy settings on our website.

Further information on data processing by Google can be found at:

https://policies.google.com/privacy?hl=de

You can manage your settings for personalized advertising at the following address:

https://myadcenter.google.com/

13. Social media presence and external links

Our website may contain links to our profiles on social networks such as Instagram or Facebook. If it is merely a link, no data is transferred to the respective platform when you visit our website. Only when you click the link do you leave our website and establish a direct connection to the provider.

The respective platform operator is generally responsible for the subsequent processing of personal data. Please refer to the privacy notices of the respective provider.

14. Protection against misuse and automated access

To protect our forms, customer accounts, and order processes from spam, automated access, and misuse, security and fraud detection services from Shopify and other technical service providers may be used.

This may include the processing of your IP address, device information, browser information, interaction data, and technical characteristics.

Processing is carried out on the basis of our legitimate interest in the security of our online shop and the prevention of unauthorized access pursuant to Art. 6(1)(f) GDPR.

15. Data transfers to third countries

Some of our service providers are based outside the European Union or European Economic Area, or process data in such countries.

A transfer is carried out only if the legal requirements are met. These include, in particular, an adequacy decision by the European Commission, appropriate safeguards such as standard contractual clauses, or another legally permissible basis.

Despite these measures, it cannot be completely ruled out that authorities in certain third countries may access personal data under the law applicable there.

16. Retention period

We only store personal data for as long as is necessary for the respective processing purpose or as long as legal retention obligations exist.

Documents relevant to contract and tax law are stored in accordance with statutory retention periods. Requests and communication data are deleted when they are no longer required for processing and there are no legal obligations or legitimate interests preventing deletion.

Data processed on the basis of your consent is generally processed until you revoke your consent, unless another legal basis permits or requires further storage.

17. Recipients of personal data

As part of the processing described in this privacy policy, personal data may be transferred to the following categories of recipients:

– hosting and store service providers,
– payment service providers and banks,
– shipping and logistics companies,
– IT, security, and support service providers,
– analysis and advertising service providers,
– tax advisors and other professional advisors, as well as
– authorities and public bodies, if there is a legal obligation.

A transfer is carried out only to the extent necessary for the respective purpose and legally permissible.

18. Your rights

Subject to the legal requirements, you have the following rights:

– right of access pursuant to Art. 15 GDPR,
– right to rectification pursuant to Art. 16 GDPR,
– right to erasure pursuant to Art. 17 GDPR,
– right to restriction of processing pursuant to Art. 18 GDPR,
– right to data portability pursuant to Art. 20 GDPR,
– right to object pursuant to Art. 21 GDPR, as well as
– right to revoke a given consent pursuant to Art. 7(3) GDPR.

If processing is based on Art. 6(1)(f) GDPR, you may object to processing at any time for reasons arising from your particular situation.

Consents can be revoked at any time with effect for the future. The lawfulness of the processing carried out until revocation is not affected by this.

To exercise your rights, you can contact us at sales@teppique.com.

19. Right to complain to a supervisory authority

You have the right to complain to a data protection supervisory authority about the processing of your personal data.

The supervisory authority responsible for our company location is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

Website:

https://datenschutz-hamburg.de/

20. Security

We implement appropriate technical and organizational measures to protect personal data against loss, tampering, unauthorized access, and other misuse.

Data transmission between your browser and our website is generally encrypted. However, complete security of data transmission over the Internet cannot be guaranteed.

21. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy if our website, the services used, or legal requirements change.

The version published on this website at any given time shall apply.

Last updated: August 2026