PRIVACY POLICY
This Privacy Policy explains how Zorimavel collects, uses and protects your personal data when you visit our website, create an account, contact us or place an order. We process your data in line with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).


CONTROLLER
Doing Business As: Zorimavel
Legal Business Name: Skinyera UG (haftungsbeschränkt)
Managing Director: Laura-Andreea Tusek
Commercial Register Number: HRB 22396
Registered Court: Amtsgericht Memmingen
Business Address: Beurener Straße 67, 89284 Pfaffenhofen a.d. Roth, Germany
Email: info@zorimavel.com
Phone: +49 157 43011444
Website: zorimavel.com


WHAT DATA WE COLLECT
Depending on how you use our website, we may collect your name, email address, phone number and billing and delivery addresses; order details such as products, shades, quantities, prices and returns; your chosen payment method and payment status (complete card or bank details are handled by our payment providers, not by us); account data if you register; messages you send us; reviews or photos you choose to share; and technical data such as your IP address, browser type, device and the pages you visit. Analytics and marketing data from cookies is only collected with your consent.

If you voluntarily tell us about your skin type, skin sensitivities or allergies, for example when asking for product advice, this may count as health-related data. We use such information only to answer your request, based on your explicit consent (Art. 9(2)(a) GDPR), and delete it once it is no longer needed.


HOW AND WHY WE USE YOUR DATA
We use your data to process and deliver your orders, manage your account, handle returns, exchanges and refunds, and answer your questions, for example about ingredients, product use or suitable skin types (Art. 6(1)(b) GDPR). We use it to keep our website secure and running smoothly and to prevent fraud, based on our legitimate interest (Art. 6(1)(f) GDPR). With your consent, we send newsletters, publish your reviews or photos, and use analytics and marketing cookies (Art. 6(1)(a) GDPR and § 25(1) TDDDG). We also keep records required by commercial and tax law (Art. 6(1)(c) GDPR). You can withdraw your consent or unsubscribe at any time.


COOKIES
Strictly necessary cookies keep your shopping cart, checkout and login working and do not require your consent (§ 25(2) TDDDG). Analytics, personalisation and marketing cookies are only set if you accept them through our cookie banner. You can change your choice at any time in the cookie settings or in your browser.


SHARING YOUR DATA
We share your data only where necessary: with payment providers to process payments, with shipping companies to deliver your order, with hosting and IT service providers working on our behalf under data processing agreements (Art. 28 GDPR), with tax advisers, and with public authorities where the law requires it. If you visit our social media pages, the platform operators process your data under their own privacy policies. Where data is transferred outside the EU or EEA, we ensure an adequate level of protection through an adequacy decision or the EU Standard Contractual Clauses. We never sell your personal data.


HOW LONG WE KEEP YOUR DATA
We keep your data only for as long as necessary. Order and invoice data is stored for up to 10 years as required by German commercial and tax law. Account data is kept until you delete your account, newsletter data until you unsubscribe, and reviews or photos until you ask us to remove them. Messages, any skin or allergy information you shared, and technical logs are deleted once they are no longer needed.


YOUR RIGHTS
You have the right to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent at any time (Art. 15 to 21 and Art. 7(3) GDPR). To exercise any of these rights, contact us at info@zorimavel.com. You also have the right to lodge a complaint with a data protection authority, such as the authority responsible for us: the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach, Germany.


DATA SECURITY
We use appropriate technical and organisational measures to protect your data, including SSL/TLS encryption across our website. Although no transmission over the internet can be guaranteed to be completely secure, we work hard to keep your data safe.


CHILDREN
Our shop is intended for adults. Purchases must be made by an adult or with the consent of a parent or legal guardian. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, please contact us so we can delete it.


AUTOMATED DECISIONS AND CHANGES
We do not use automated decision-making or profiling that has legal or similarly significant effects on you. We may update this Privacy Policy from time to time, and the latest version is always available on our website.