DATA PROTECTION
Privacy Policy
As of: 10 September 2026
With this privacy policy, we inform you which personal data we process when you visit our online shop makani-germany.de, place an order with us or contact us, for what purposes and on what legal basis this takes place, to whom we disclose data, how long we store it and what rights you have.
1. Controller
Makani GmbH, represented by its managing director Serkan Dagdelen
Obstmarschenweg 258, 21683 Stade, Germany
Email: kontakt@makani-germany.de
2. Legal bases at a glance
We process personal data on the basis of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following are particularly relevant:
– Art. 6 (1) (a) GDPR – your consent
– Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures
– Art. 6 (1) (c) GDPR – compliance with legal obligations (e.g. retention obligations under commercial and tax law)
– Art. 6 (1) (f) GDPR – safeguarding our legitimate interests, insofar as your interests do not prevail
The storage of information on your end device or access to information already stored there (e.g. cookies, local storage, pixels) takes place pursuant to Section 25 (1) TDDDG only with your consent, unless the process is strictly necessary pursuant to Section 25 (2) TDDDG to provide the service you have expressly requested (e.g. shopping cart, checkout, storage of your cookie selection).
3. Hosting, provision of the website and server log files
Our online shop is operated on the Shopify e-commerce platform. The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides us with servers, a database, checkout and content delivery infrastructure and, as our processor (Art. 28 GDPR), processes all data that you enter in the shop or that is generated during use. Shopify uses sub-processors, including its parent company Shopify Inc. (Canada) and providers in the USA. The EU Commission has adopted an adequacy decision for Canada; transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.
For fast and secure delivery of content, Shopify uses the content delivery and security network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your IP address is processed in this process. Cloudflare is certified under the EU-U.S. Data Privacy Framework.
When you visit our website, the following data is automatically collected in server log files: IP address, date and time of access, page or file accessed, amount of data transferred, notification of successful retrieval, referrer URL, browser type and version, operating system. The processing serves to deliver the website, ensure stability and security, and prevent and investigate attacks and misuse. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in maintaining a secure and functional online shop. Shopify or Cloudflare stores the log data only for as long as necessary for these purposes and then deletes or anonymizes it; we do not combine it with other data sources for advertising purposes.
4. SSL or TLS encryption
For security reasons, this website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” in your browser’s address bar and by the padlock symbol in your browser. When encryption is active, the data you transmit to us cannot be read by third parties.
5. Cookies and consent management
We use cookies and similar technologies. Strictly necessary cookies (e.g. for the shopping cart, checkout, language and currency selection, security, and storing your cookie selection) are placed on the basis of Section 25 para. 2 TDDDG and Art. 6 para. 1 lit. b or f GDPR. All other cookies and technologies for statistics, personalization, and marketing may be used only with your consent (Section 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR). Merely using the website does not constitute consent.
To obtain and manage your consent, we use the consent management app Pandectes GDPR Compliance (Pandectes P.C., Greece). Your selection, the date and time, and a consent ID are stored in the “_pandectes_gdpr” cookie for 12 months. The legal basis is Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR (proof of consent).
You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again. You can also delete or block cookies in your browser; individual functions may then be unavailable.
6. Contact and customer service
If you contact us by email or via the contact form, we process your information (e.g. name, email address, order number, content of the inquiry) to handle your inquiry. The legal basis is Art. 6 para. 1 lit. b GDPR insofar as your inquiry is related to a contract; otherwise, Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).
We use a helpdesk system with AI-assisted support (Resolvia.ai) to process customer inquiries. The content and metadata of your inquiry, as well as the associated order data, are processed to prepare responses and assign inquiries. Our team reviews the responses; no decision based solely on automated processing with legal effect is made. The provider is bound as a processor. We delete inquiries as soon as they have been conclusively processed and no statutory retention obligations prevent this.
7. Ordering and contract fulfillment
When you place an order with us, we process the data required to fulfill it: name, billing and delivery address, email address, telephone number where applicable, order and payment data, and information on returns and complaints. The legal basis is Art. 6 para. 1 lit. b GDPR. Mandatory information is marked during the ordering process; without it, we cannot conclude the contract.
We retain documents relevant under commercial and tax law (e.g., invoices, accounting records) for six or eight years in accordance with Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code (Art. 6 para. 1 lit. c GDPR). We delete other contractual data after the statutory warranty and limitation periods have expired.
We send the order confirmation and other transactional emails (e.g., shipping confirmation) via Shopify.
8. Customer account
You can create a customer account in the shop. In doing so, we process the data you provide and your order history to give you access to your orders and enable faster ordering (Art. 6 para. 1 lit. b GDPR). You can have your customer account deleted at any time; statutory retention obligations remain unaffected.
9. Shipping, storage, and returns
For delivery, we provide your name, delivery address, and order details to our fulfillment service provider, which stores, packages, and ships the goods and accepts returns (VDS Fulfillment, Herzberg am Harz; inventory management via software from Alaiko GmbH, Germany). Delivery is carried out by Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, or their partners in the destination country. The legal basis is Art. 6 para. 1 lit. b GDPR.
We provide your email address and, where applicable, telephone number to the parcel delivery service so that it can inform you of the delivery date. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in ensuring smooth delivery. You may object at any time.
You register returns through our returns portal, which is provided by Alaiko GmbH. For returns from Switzerland, we use the portal of exporto GmbH, Germany. The order and contact details required for the return are processed (Art. 6 para. 1 lit. b GDPR).
10. Payment service providers
You enter your payment details directly with the respective payment service provider or in the Shopify checkout; we do not receive complete card details. The transfer of data required for payment is based on Art. 6 para. 1 lit. b GDPR. We offer the following payment service providers:
– Shopify Payments (credit and debit cards, Apple Pay, Google Pay, and others): Payment processing is carried out through Shopify and Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland.
– Shop Pay: Shopify International Limited (see Section 3). If you use Shop Pay, your data will additionally be stored in your Shop account.
– PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
– Klarna (e.g., invoice, installment purchase, direct debit): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For purchases by invoice or installment, Klarna conducts an identity and creditworthiness check to safeguard legitimate interests and may use credit reference agencies for this purpose; further information can be found in Klarna's privacy policy.
– TWINT (Switzerland): TWINT AG, Stauffacherstrasse 31, 8004 Zurich, Switzerland. An adequacy decision by the European Commission applies to Switzerland.
On product pages and in the shopping cart, we display information from Klarna about payment options (on-site messaging). In this process, your IP address is transmitted to Klarna; Klarna only sets cookies for this purpose with your consent.
11. Newsletter and Email Marketing (Klaviyo)
If you sign up for our newsletter, we process your email address and, where applicable, your first name and date of birth to send you regular information about products, promotions, and new products. Registration uses a double opt-in process: You receive an email in which you confirm your registration. We store the time and IP address of registration and confirmation as evidence. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR).
We use Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA, to send our emails. Klaviyo is certified under the EU-US Data Privacy Framework; we have also entered into EU Standard Contractual Clauses. We analyze whether and when a newsletter was opened and which links were clicked in order to improve our content; this is part of your consent.
If you have already purchased from us, we may also send you emails about our own similar products without separate consent (§ 7 para. 3 UWG, Art. 6 para. 1 lit. f GDPR). You can object to this at any time.
You can unsubscribe from the newsletter at any time via the unsubscribe link in any email or by sending us a message. After unsubscribing, your data will be deleted or stored on a suppression list so that you do not receive any further emails.
With your consent, Klaviyo also sets cookies on our website (e.g. “__kla_id”, for up to 2 years) to associate visits to the website with your newsletter profile (e.g. for cart reminders). For information about the fonts loaded by Klaviyo’s signup forms, see Section 16.
12. Product reviews
After an order, we ask you by email to review the products you purchased. For this purpose, we use the Loox (Loox Inc.) and Judge.me (Judge.me Ltd.) apps. We base the review request on Art. 6 para. 1 lit. f GDPR (legitimate interest in customer feedback); you can object at any time. If you submit a review, we publish it with your first name or the name you choose and, where applicable, your photos (Art. 6 para. 1 lit. a GDPR). The providers process the data as processors; where data is transferred to third countries, this is done on the basis of adequacy decisions (e.g. Israel) or EU Standard Contractual Clauses.
13. Shop functions through apps
For certain functions of our shop, we use third-party apps integrated via Shopify. Where this does not require cookies or the function is expressly requested by you, the legal basis is Art. 6 para. 1 lit. b or f GDPR; otherwise, your consent. The providers are bound to us as processors.
– Translation: Weglot SAS, France – provides the language versions of our shop; your IP address is processed for this purpose.
– Free items and promotions: BOGOS.io (Secomapp) – manages free items in the shopping cart; transfers to third countries are carried out on the basis of EU Standard Contractual Clauses.
– Post-purchase upsell: Aftersell – displays additional offers after checkout.
– Preorders and countdown: Essential Preorder and Essential Countdown Timer (Essential Apps).
– “Notify me”: Kbite (Staqlab) – informs you by email when an out-of-stock item becomes available again. For this purpose, we process your email address on the basis of your consent and delete it after sending the notification or after 12 months.
– Landing pages: Replo, Inc., USA – page builder for individual promotional pages.
– Load-time optimization: Hyperspeed – accelerates the loading of our pages.
– Product data feeds: Channable B.V., Netherlands, and Simprosys (Google Shopping Feed) – transmit product data to advertising and price comparison platforms; visitors’ personal data is processed only as part of the conversion measurement described in Section 15.
14. Statistics and analytics (only with consent)
We only use the following services if you consent to the “Statistics/Performance” category in the cookie banner (Art. 6 para. 1 lit. a GDPR, Section 25 para. 1 TDDDG). You can withdraw your consent at any time.
- Shopify Analytics: Shopify records page views and interactions in the shop to provide us with analyses (cookies such as “_shopify_y” for up to 1 year, “_shopify_s” for 30 minutes).
- Google Analytics 4 and Google Tag Manager: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics creates pseudonymous usage profiles (page views, time spent, device information, approximate location); IP addresses are truncated in the EU. Google Tag Manager is used to manage website tags and does not itself process profiles. Cookies: “_ga”, “_ga_*” for up to 2 years. Transfers to Google LLC in the USA are based on the EU-US Data Privacy Framework.
- Microsoft Clarity: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records mouse movements, clicks, and scrolling behavior to create heatmaps and anonymized session replays; entries in form fields are masked. Cookies: “_clck” for up to 1 year, “_clsk” for 1 day. Transfers to the USA are based on the EU-US Data Privacy Framework.
- Hotjar: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St. Julian’s STJ 3141, Malta. Hotjar creates heatmaps and session recordings; form entries are masked. Cookies “_hjSessionUser_*” for up to 1 year, “_hjSession_*” for 30 minutes. The data is stored in the EU.
- Triple Whale: Triple Whale Inc., USA - combines data from our shop and advertising channels to measure the success of our marketing activities (attribution). Pseudonymous identifiers, page views, click sources, and order data are processed. Transfers to the USA are based on EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
- A/B testing and personalization: Visually.io and conversion.io - deliver different versions of our pages and measure which performs better. Pseudonymous identifiers and usage data are processed; transfers to third countries are based on EU Standard Contractual Clauses.
The analytics data is deleted as soon as it is no longer needed for evaluation, and at the latest after 14 months, unless a shorter period is specified in the settings of the respective service.
15. Marketing and conversion measurement (only with consent)
We only use the following services if you consent to the “Marketing” category in the cookie banner (Art. 6 para. 1 lit. a GDPR, Section 25 para. 1 TDDDG). They help us measure the success of our advertising and show you relevant advertising on other websites and platforms. For this purpose, pseudonymous identifiers, information about your device and browser, pages visited, cart and purchase events, and - if you are logged in or place an order - hashed contact details are transmitted to the providers. You can withdraw your consent at any time.
– Meta Pixel and Conversions API: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for the collection and transfer of the data (Art. 26 GDPR); you can find the relevant agreement at Meta under “Controller Addendum”. Meta is solely responsible for further processing. Cookie “_fbp” for up to 3 months. Transfers to Meta Platforms, Inc. (USA) are based on the EU-US Data Privacy Framework.
– Google Ads, conversion tracking and remarketing (including Google Marketing Platform/DoubleClick): Google Ireland Limited (address see section 14). Cookies such as “_gcl_au”, “_gcl_aw” for up to 3 months, “IDE” for up to 13 months. Transfers to the USA are based on the EU-US Data Privacy Framework.
– Pinterest Tag: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Cookie “_pin_unauth” for up to 1 year. Transfers to the USA are based on the EU-US Data Privacy Framework.
– Taboola: Taboola Europe Limited or Taboola, Inc., USA - measurement and delivery of ads in recommendation networks on news and content sites. Transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
– Microsoft Advertising: Microsoft Ireland Operations Limited (address see section 14) - conversion measurement for ads in Bing Search. Cookie “MUID” for up to 1 year.
– Sovendus: Sovendus GmbH, Hermann-Veit-Straße 6, 76135 Karlsruhe - after your order, we show you a voucher offer from partner companies on the order confirmation page. Hashed, pseudonymized information (e.g. order number, order value, timestamp) is transmitted for this purpose. Only if you actively select an offer will your salutation, name, and email address be transmitted to Sovendus.
– RetentionX: Analysis of purchase and customer data to optimize customer retention and advertising expenditure.
– Klaviyo onsite tracking: see section 11.
The advertising cookies are deleted no later than after the periods specified above.
16. Fonts
The fonts used in our shop design are loaded via the Shopify CDN or from our own servers; no connection to Google's servers is established for this purpose.
Our newsletter signup forms (Klaviyo, see section 11) may load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In doing so, your IP address is transmitted to Google; transmission to the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), insofar as the forms are loaded only after consent; otherwise, our legitimate interest in ensuring a consistent presentation (Art. 6(1)(f) GDPR). We are working to embed these fonts locally as well.
17. Social media presence
We operate profiles on Instagram, Facebook and TikTok. When you visit these profiles, the platform operators process your data in accordance with their own privacy policies. We are jointly responsible with Meta for analyzing page statistics (Insights) (Art. 26 GDPR). On our website, we merely link to these profiles; simply visiting our website does not transmit any data to the networks.
18. Data transfers to third countries
Some of the providers mentioned are based outside the EU or EEA or transfer data there. We transfer data only if an adequacy decision by the European Commission exists for the country concerned (e.g. Canada, Switzerland, Israel, the United Kingdom or - for certified companies - the United States under the EU-US Data Privacy Framework of 10 July 2023) or if appropriate safeguards under Art. 46 GDPR are in place, in particular the EU standard contractual clauses. You can view the certification status of US companies at dataprivacyframework.gov.
19. Retention period
Unless a specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. The data will then be deleted or, if deletion is not possible due to statutory retention obligations, its processing will be restricted.
20. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to withdraw consent already given at any time with effect for the future (Art. 7 para. 3 GDPR). Simply contact kontakt@makani-germany.de for this purpose.
Right to object: If we process your data on the basis of Art. 6 para. 1 lit. f GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR). You may object to processing for the purposes of direct marketing at any time without giving reasons (Art. 21 para. 2 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is the data protection authority of the state of Lower Saxony: State Commissioner for Data Protection of Lower Saxony (LfD), Prinzenstraße 5, 30159 Hannover.
21. Automated decisions
We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR. When purchasing on account or in installments through Klarna, Klarna decides on the basis of an automated credit assessment whether this payment method will be offered; you can then choose another payment method and contact Klarna for details.
22. Changes
We will update this Privacy Policy if the services we use or the legal situation changes. The version published here at the relevant time shall apply.