Privacy Policy
Welcome to the Privacy Policy of Havornelix. This policy explains what personal data we collect, why we collect it, how we protect it and what rights you have in relation to it. We process your data in accordance with the General Data Protection Regulation (GDPR) and the applicable German data protection laws.
Summary
Data we collect automatically
When you visit Havornelix, we automatically collect certain data, such as Usage Data, device information and data collected through Trackers like cookies. Trackers that are not strictly necessary are only used with your consent.
Data you give to us
When you place an order or contact us, you give us data such as your name, email address, delivery and billing address, phone number (if provided), payment information and purchase history.
How we use it
We use your data to run our online shop, process and deliver your orders, handle payments, answer your questions and, where you have agreed, to analyse how our shop is used and show you relevant advertising.
Who helps us process it
We work with trusted service providers, such as our shop platform and hosting provider, payment service providers, shipping carriers and IT service providers. They only process your data on our instructions or for the specific purposes described in this policy.
Owner and Data Controller
SOXI UG (haftungsbeschränkt)
Spitzwegwinkel 7
94315 Straubing
Germany
Registered at the Amtsgericht Straubing, HRB 13871
Managing Director: Xueran Sun
Email: hey@havornelix.com
Phone: +4915511521547
Types of Data We Collect
Among the types of Personal Data that Havornelix collects, by itself or through third parties, are:
Trackers
Usage Data, such as page views, clicks, session duration, browsing history within our shop and interaction events
Device information
Name
Email address
Delivery and billing address
Phone number
Payment information
Purchase history
Details on each type of Personal Data are given in the relevant sections of this Privacy Policy or in specific information shown before the data is collected.
You provide most Personal Data yourself, for example when placing an order or contacting us. Usage Data is collected automatically when you use our shop.
Data marked as mandatory during checkout is needed to process your order. If you do not provide it, we cannot complete your purchase. Where data is optional, you are free not to provide it without any effect on your order. If you are unsure which data is mandatory, please contact us.
How and Where We Process Your Data
Methods of Processing
We take appropriate technical and organisational security measures to prevent unauthorised access, disclosure, modification or destruction of your data. Our website uses SSL/TLS encryption, which you can recognise by the lock symbol in your browser's address bar.
Your data is processed using computers and IT tools, following procedures strictly related to the purposes described in this policy. Besides us, your data may be accessible to external parties that support the operation of our shop, such as technical service providers, hosting providers, payment service providers, shipping carriers and IT companies. Where these parties process data on our behalf, they act as Data Processors under a data processing agreement in accordance with Article 28 GDPR. You can request an updated list of these parties from us at any time.
Place of Processing
Your data is processed at our business premises and in any other places where the parties involved in the processing are located.
Some of our service providers may be located outside the European Union or the European Economic Area, for example in the United States. In these cases, we make sure your data is protected by appropriate safeguards, such as an adequacy decision of the European Commission, including the EU US Data Privacy Framework, or the European Commission's Standard Contractual Clauses.
Purposes of Processing
We process your data to provide our services, process your orders, comply with our legal obligations, respond to requests from authorities, protect our rights and interests and those of our customers, and detect fraudulent or malicious activity. In addition, we process data for the following purposes:
Platform services and hosting
Handling payments
Shipping and delivery
Managing support and contact requests
Order and service emails
Traffic optimisation and security
Displaying content from external platforms
Analytics
Advertising and remarketing
Detailed Information on the Processing of Personal Data
Platform Services and Hosting
These services host and run the main components of our online shop, including our product catalogue, shopping cart, checkout and order management. They allow us to operate Havornelix from a single platform, which involves the processing of Personal Data such as device information, Usage Data and order details.
Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (our legitimate interest in operating a secure and functional online shop).
Handling Payments
All payments are processed by external payment service providers. You enter your payment details directly with the payment provider. We do not receive or store your full credit card or bank details. We only receive a notification from the payment provider confirming whether the payment was successful, along with the information needed to match it to your order.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Shipping and Delivery
To deliver your order, we share your name and delivery address with the shipping carrier. Where needed to notify you about your delivery, we may also share your email address or phone number with the carrier.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Managing Support and Contact Requests
When you contact us by email or phone, we process the information you provide, such as your name, email address, phone number, order number and the content of your message, to answer your request.
Legal basis: Article 6(1)(b) GDPR where your request relates to an order or contract, and otherwise Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries).
Order and Service Emails
We send you emails that are necessary for your order, such as your order confirmation, shipping confirmation and information about returns and refunds. We do not send you advertising emails.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Traffic Optimisation and Security
These services distribute our content through servers in different locations and protect our shop against attacks and misuse. They process Usage Data such as your IP address in order to filter communication between our shop and your browser.
Legal basis: Article 6(1)(f) GDPR (our legitimate interest in a fast and secure website).
Displaying Content from External Platforms
These services, such as embedded fonts or widgets, allow us to show content hosted on external platforms directly on our pages. They may collect Usage Data for the pages where they are installed, even if you do not interact with them.
Legal basis: your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG, unless the service is strictly necessary to display our website, in which case Article 6(1)(f) GDPR and Section 25(2) TDDDG apply.
Analytics
Analytics services help us understand how visitors use our shop, for example which pages are visited most often and how long visitors stay. This helps us improve our shop and our products. These services may use Trackers and process Usage Data such as page views, clicks, session duration and device information.
Legal basis: your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Advertising and Remarketing
Advertising and remarketing services allow us to measure the success of our ads and to show you advertising on other websites and platforms based on your earlier visits to our shop. These services use Trackers to recognise your browser or device.
Legal basis: your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You can withdraw your consent to analytics, advertising and remarketing at any time through the cookie settings on our website. Many advertising services also offer their own opt out options, which you can find in their privacy policies.
Cookies and Similar Technologies
Havornelix uses cookies and similar Trackers. Cookies are small text files that are stored on your device when you visit our shop.
Strictly necessary cookies are required for our shop to work, for example to keep items in your shopping cart, complete your checkout and remember your cookie settings. These cookies do not require your consent.
All other cookies and Trackers, such as those used for analytics, advertising and remarketing, are only used if you have given your consent through our cookie banner. You can change or withdraw your consent at any time through the cookie settings on our website. You can also delete or block cookies in your browser settings, although some parts of our shop may then no longer work properly.
Legal Basis of Processing
We only process your Personal Data if one of the following applies:
You have given your consent for one or more specific purposes (Article 6(1)(a) GDPR).
The processing is necessary to perform a contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).
The processing is necessary to comply with a legal obligation we are subject to (Article 6(1)(c) GDPR).
The processing is necessary for our legitimate interests or those of a third party, provided these are not overridden by your interests or fundamental rights (Article 6(1)(f) GDPR).
We are happy to explain which specific legal basis applies to any processing, and whether providing your data is a legal or contractual requirement.
Retention Periods
We only store your Personal Data for as long as it is needed for the purpose it was collected for, unless we are legally required or permitted to keep it longer.
Data collected to perform a contract with you is kept until the contract has been fully performed.
Order and invoice data is kept for up to 10 years, as required by German commercial and tax law.
Data processed based on our legitimate interests is kept for as long as needed to fulfil those interests.
Data processed based on your consent is kept until you withdraw your consent.
Technical log data is usually deleted after a short period, unless it is needed to investigate a security incident.
Once the retention period has expired, your data is deleted. After that, the rights of access, erasure, rectification and data portability can no longer be exercised.
Your Rights Under the GDPR
You have the following rights regarding the data we process about you:
Withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Object to processing. Where we process your data based on our legitimate interests, you can object for reasons relating to your particular situation. You can object to processing for direct marketing purposes at any time, free of charge and without giving a reason.
Access your data. You can find out whether we process your data, receive information about the processing and obtain a copy of your data.
Have your data corrected. You can check the accuracy of your data and ask for it to be updated or corrected.
Restrict processing. In certain cases, you can ask us to restrict the processing of your data. We will then only store it and not use it for any other purpose.
Have your data deleted. You can ask us to delete your data, unless we are legally required to keep it.
Receive your data and have it transferred. You can ask to receive your data in a structured, commonly used and machine readable format and, where technically feasible, have it transferred to another controller.
Lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
You can also learn about the legal basis for transfers of your data outside the European Union and the safeguards we use to protect it.
How to Exercise Your Rights
You can send any request to exercise your rights to hey@havornelix.com. Requests are free of charge and will be answered as soon as possible, and always within one month. If we correct or delete your data or restrict its processing, we will inform any recipients we have shared it with, unless this is impossible or involves disproportionate effort. On request, we will tell you who those recipients are.
Additional Information About Data Collection and Processing
Legal Action
We may use your Personal Data in court or in the steps leading up to possible legal action arising from improper use of our shop or our services. We may also be required to disclose Personal Data at the request of public authorities.
System Logs and Maintenance
For operation and maintenance purposes, our shop and any third party services we use may collect files that record interactions with our shop (system logs) or use other Personal Data, such as your IP address.
Information Not Contained in This Policy
You can request more details about the collection or processing of your Personal Data from us at any time using the contact details at the beginning of this document.
Children
Our shop is not directed at children under the age of 16, and we do not knowingly collect Personal Data from them.
Changes to This Privacy Policy
We may change this Privacy Policy at any time, for example when we add new services or when the law changes. We will publish any changes on this page. Please check this page from time to time and refer to the date of the latest update at the top. Where changes affect processing based on your consent, we will ask for your consent again if required.