Privacy Policy
PRIVACY POLICY
Dulatov Fragrances GmbH
Last updated: July 2026
Protecting your personal data is important to us. This Privacy Policy explains what personal data we collect, the purposes for which we process it, and the rights available to you. It is based on the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. CONTROLLER
The controller responsible for data processing on this website is:
Dulatov Fragrances GmbH
Königsallee 19
40212 Düsseldorf
Germany
Managing Director: Recep Bayram
Email: info@dulatovfragrances.com
Commercial Register: HRB 110900, Düsseldorf Local Court (Amtsgericht Düsseldorf)
VAT ID: DE462536561
We have not appointed a Data Protection Officer, as there is no legal obligation to do so. For any privacy-related questions, please contact us at the email address above.
2. GENERAL INFORMATION ON DATA PROCESSING
Scope of processing
As a rule, we process our users' personal data only to the extent necessary to provide a functional website and our content and services, or where you have given your consent.
Legal bases
The processing of your data is carried out on the basis of:
- Art. 6(1)(a) GDPR — your consent (e.g. newsletter, WhatsApp, non-essential cookies)
- Art. 6(1)(b) GDPR — performance of a contract (e.g. order processing, shipping)
- Art. 6(1)(c) GDPR — legal obligation (e.g. tax retention requirements)
- Art. 6(1)(f) GDPR — legitimate interest (e.g. fraud prevention, security, reach measurement)
3. PROVISION OF THE WEBSITE AND SERVER LOG FILES
Each time our website is accessed, our system automatically collects data and information from the accessing device. This includes: IP address, date and time of access, pages visited, browser and operating system used, and the referrer URL.
This data is stored in the log files of our system or our hosting provider. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the trouble-free operation and security of our website.
4. SHOP SYSTEM AND HOSTING (SHOPIFY)
Our online shop is operated via the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
When you visit our shop or place an order, Shopify processes the required data on our behalf (including order, contact, payment and usage data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (secure and efficient operation).
A Data Processing Agreement (DPA) under Art. 28 GDPR is in place with Shopify. A transfer of data to the USA (parent company Shopify Inc.) cannot be excluded; such transfers are based on the EU Standard Contractual Clauses.
5. ORDER PROCESSING AND CUSTOMER ACCOUNT
When you place an order, we collect the data required to process the contract: name, billing and delivery address, email address, telephone/WhatsApp number where applicable, and payment data.
Processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR). To meet commercial and tax retention obligations (Art. 6(1)(c) GDPR), we store invoice and contract data for the legally prescribed periods (generally up to 10 years).
6. PAYMENT PROCESSING
To process payments, we work with various payment service providers. Depending on the payment method you choose, your payment data is transmitted to the respective provider. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
We use the following providers:
- Shopify Payments — Shopify International Limited, Dublin, Ireland
- PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg
- Klarna — Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
- Stripe — Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland
The respective providers process your data as independent controllers in accordance with their own privacy policies. For some payment methods (e.g. Klarna), a credit check may be carried out.
7. SHIPPING (DHL)
To deliver your order, we pass on your shipping data (name, delivery address and — where required for tracking or notification — email address or telephone number) to our shipping provider:
DHL — DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract). DHL processes the data for delivery as an independent controller.
8. INVOICING (PATHWAY)
For the automated creation and legally compliant archiving of invoices, we use the service Pathway. This involves processing the order and contact data required for invoicing.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with legal retention obligations). A Data Processing Agreement under Art. 28 GDPR is in place with the provider.
9. NEWSLETTER AND EMAIL MARKETING (KLAVIYO)
To send newsletters, early-access codes and other marketing messages, we use the service Klaviyo. The provider is Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA.
When you sign up for our newsletter or early access, your email address and any other data you provide are transmitted to and stored by Klaviyo. Registration takes place using the double opt-in procedure, meaning you receive a confirmation email after signing up.
The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, e.g. via the unsubscribe link in every email or by message to info@dulatovfragrances.com.
Klaviyo also processes data in the USA. The transfer is based on the EU Standard Contractual Clauses. A Data Processing Agreement under Art. 28 GDPR is in place with Klaviyo.
10. WHATSAPP COMMUNICATION (SUPERCHAT)
For communication via WhatsApp — in particular sending early-access codes and service messages — we use the service Superchat. The provider is Superchat GmbH, Torstraße 19, 10119 Berlin, Germany.
When you provide us with your WhatsApp number via our form and consent to receiving messages, we process your telephone number and the content of the communication in order to send you the requested messages. The legal basis is your consent under Art. 6(1)(a) GDPR.
You can withdraw your consent to receiving WhatsApp messages at any time by sending us a corresponding message. Please note that the operator of the WhatsApp service (Meta Platforms Ireland Ltd.) processes its own data, over which we have no influence.
11. COOKIES AND CONSENT MANAGEMENT
Our website uses cookies. Cookies are small text files stored on your device. We distinguish between technically necessary cookies and consent-based cookies (e.g. for statistics and marketing).
Technically necessary cookies are set on the basis of Art. 6(1)(f) GDPR and Section 25(2) TDDDG. All other cookies and tracking technologies are set only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) via our cookie banner.
You can adjust or withdraw your consent at any time via the cookie settings on our website.
12. WEB ANALYTICS AND MARKETING (TRACKING)
To analyse the use of our website and to display interest-based advertising, we use the following services — only with your consent. The legal basis in each case is Art. 6(1)(a) GDPR.
Google Analytics
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse website usage. The information generated may be transmitted to Google servers, including in the USA (basis: EU Standard Contractual Clauses).
Meta Pixel (Facebook/Instagram)
Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The Meta Pixel enables the measurement of advertising success and the display of personalised advertising on Facebook and Instagram.
TikTok Pixel
Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. The TikTok Pixel is used to measure and optimise advertising campaigns on TikTok.
For all the services mentioned, data may be transferred to third countries (in particular the USA). You can withdraw your consent at any time via the cookie settings.
13. SOCIAL MEDIA PRESENCE
We maintain a presence on social networks (including Instagram and TikTok). When you interact with our profiles, the respective providers process your data in accordance with their own privacy policies. The legal basis for our presence is Art. 6(1)(f) GDPR (legitimate interest in external representation and communication).
14. RECIPIENTS AND TRANSFER TO THIRD COUNTRIES
Your data is transferred to third parties only within the scope of the purposes set out in this policy, in particular to processors (e.g. Shopify, Klaviyo, Superchat, Pathway), payment service providers, the shipping provider, and authorities where legally required.
As we ship worldwide, your data — in particular name, address and contact details — may also be transferred to recipients outside the EU/EEA where necessary to deliver your order. In addition, some of the services we use (e.g. Klaviyo, Google, Meta, TikTok) process data in third countries, in particular the USA.
Where data is transferred to countries outside the EU/EEA, we ensure an adequate level of data protection through the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Where no adequacy decision or appropriate safeguards apply, transfers only take place where permitted under Art. 49 GDPR (e.g. because the transfer is necessary for the performance of your delivery contract).
15. YOUR RIGHTS AS A DATA SUBJECT
Under the GDPR, you have the following rights:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, simply email info@dulatovfragrances.com. We may request appropriate proof to verify your identity.
16. RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is, in particular, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
17. RETENTION PERIOD
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. Thereafter, the data is deleted or anonymised.
18. CHILDREN'S DATA
Our offering is aimed at a general audience and not at children. We do not knowingly collect data from persons under the age of 16.
19. CHANGES TO THIS PRIVACY POLICY
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services. The version available at the time of your visit applies.
---
Note: This draft has been carefully prepared based on the services you named, but does not replace legal review. We recommend having it checked by a lawyer before publishing.