Privacy policy

This English version is provided for your convenience. Only the German version is legally binding.

Here we explain which personal data is processed when you visit our online shop and when you place an order.

1. Controller

HAJUS AG
Spinnereistraße 3
01591 Riesa
Germany
kundenservice@liorelash.com
Phone: +49 5151 8779810

2. Visiting the website

When you visit the website, technically necessary data is processed. This can include the IP address, date and time, the page visited, the amount of data transferred, the referrer and browser and device information. The processing serves the secure and stable operation of the shop on the basis of Art. 6(1)(f) GDPR.

3. Cart and technically necessary storage

The shop stores a random cart identifier so that a cart can be assigned to you while you shop. This storage is necessary for the shop function you requested. No consent is required for it.

So that nothing you typed in the checkout is lost when you leave it for a moment, your browser keeps your contact and address details in the session storage of this tab; they are deleted when the tab is closed. Only if you tick “Remember my details on this device for my next order” do they stay in your browser’s local storage for up to 30 days (liore-checkout); removing the tick deletes them at once. These details leave your device only when you submit the order. The legal basis is § 25(2)(2) TDDDG (a function you requested) or your consent given by the tick (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If a payment is interrupted, we show the details of the still unpaid order again in the checkout of this browser for up to two hours.

4. Orders and contract processing

When you place an order, we process the contact, billing, delivery and order data you provide. This is necessary to take pre-contractual steps and to perform the contract under Art. 6(1)(b) GDPR. After the contract has been fully processed, the data is restricted from further use and deleted when the retention periods under tax and commercial law expire, unless consent or another legal basis permits further processing.

For address suggestions while you type the street in the checkout, our server sends the text you typed (not your name and not your IP address) to the Geoapify service (KEPTAGO LTD, N. Nikolaidi & T. Kolokotroni, Onisiforou Center, 8011 Paphos, Cyprus – EU); the requests are processed only within the EU. We have a data processing agreement with Geoapify under Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR (processing your order) and our legitimate interest in correct delivery addresses (Art. 6(1)(f) GDPR). Without suggestions you can type the address yourself as usual.

For the loyalty points programme we book the points of your orders and their redemption against your email address (Art. 6(1)(b) GDPR). We keep these bookings while you take part in the programme, at most until the retention periods of the related orders end.

5. Contacting us

When you contact us by email, we process your details to handle your enquiry. Depending on the content, the legal basis is Art. 6(1)(b) or (f) GDPR.

If you subscribe to our newsletter, we process your email address to send you new arrivals, application tips and offers from Liore Lash. Subscribing uses the double opt-in procedure: you first receive an email with a confirmation link (valid for 7 days); only after you confirm do we send the newsletter and your single-use discount code. As proof of your consent we store the times of subscribing and confirming. The legal basis is your consent (Art. 6(1)(a) GDPR). Subscriptions that are never confirmed are deleted after 30 days.

You can withdraw your consent at any time with effect for the future – via the unsubscribe link in every email or by writing to kundenservice@liorelash.com. After unsubscribing you receive no further newsletters; we keep your email address with the times of subscribing, confirming and unsubscribing only to be able to prove the earlier consent and not to hand out the single-use discount code again (legitimate interest, Art. 6(1)(f) GDPR).

7. Product reviews

You can review items in our shop. For this we process your star rating, your text, the optional headline, the display name you choose, your email address, the optional order number and the date and time of submission. Only the stars, headline, text, display name and date are shown publicly, plus the note “Verified purchase” where it applies. We do not publish the email address and order number; we use them to confirm a purchase, to prevent multiple reviews and to reach you with questions about your review.

The legal basis for publication is your consent under Art. 6(1)(a) GDPR, which you give in the review form. The check before publication for spam, legal violations and relevance to the product, and the match with an order, are based on our legitimate interest in genuine reviews free of abuse (Art. 6(1)(f) GDPR). Published reviews are publicly visible and can be indexed by search engines.

The details are stored in our shop system for as long as the review is published or needed for the check. You can withdraw your consent at any time with effect for the future, for example by email to kundenservice@liorelash.com. We will then remove the review and delete the related details.

8. Withdrawal through the online withdrawal function

If you withdraw from your contract using the “Withdraw from contract” button, we process your name, the order number, your email address, optionally the order date and your note, and the date and time of receipt. We use these details to process the withdrawal, to match it to an order and to confirm its receipt to you without delay on a durable medium by email. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB), and Art. 6(1)(b) GDPR for unwinding the contract. We do not store your IP address for this; to prevent abuse, only the number of submissions is counted briefly in memory. We keep the details until the retention periods under commercial and tax law expire.

9. Recipients and processors

We pass on data only where this is necessary to run the shop, to process the contract or because of a legal obligation. This can include hosting and infrastructure providers, shipping providers, email providers and our inventory management system. Processors we use are bound by contract under Art. 28 GDPR.

Payment processing: if you pay with PayPal, we transmit the data required for this (name, address, email address, order number, amount) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (Art. 6(1)(b) GDPR). PayPal’s privacy statement applies.

10. Analytics and advertising with Google (only with consent)

Only if you choose “Accept all” in the cookie banner do we load Google Tag Manager and, through it, Google Analytics 4 and Google Ads (conversion tracking and remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent no connection to Google servers is made and no Google cookies are set.

The purpose is the statistical analysis of how our shop is used (e.g. pages visited, time spent, where the visit came from, device, browser, approximate location) and measuring and optimising our ads. For this, cookies or similar technologies are stored on and read from your device, in particular _ga and _ga_* (stored for up to 2 years) and _gcl_* (up to 90 days). Google Analytics 4 does not store IP addresses. Your choice is passed on to the Google services through Google Consent Mode.

The legal basis is your consent under § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(a) GDPR. Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR).

We store your choice for 12 months in your browser’s local storage (liore-consent); after that we ask again. You can withdraw your consent at any time with effect for the future: open “Privacy settings” in the page footer and choose “Decline” – the Google cookies are deleted. More information is in Google’s privacy policy.

11. Your rights

Subject to the legal requirements, you have in particular the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and withdraw consent you have given at any time with effect for the future.

12. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular the authority of your usual place of residence, your place of work or the place of the alleged infringement.

13. Security and updates

The website is transmitted encrypted. We review this privacy policy and update it when the services we use or the legal requirements change.

As of: October 2026