Privacy policy
Privacy policy
As of September 10, 2026
In this Privacy Policy, we inform you about what personal data we process when you visit our online store at makani-germany.de, place an order with us, or contact us; for what purposes and on what legal basis this occurs; to whom we disclose data; how long we store it; and what rights you have.
1. Data Controller
Makani GmbH, represented by its managing director, Serkan Dagdelen
Obstmarschenweg 258, 21683 Stade, Germany
E-mail:makani
2. Overview of the Legal Basis
We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The following provisions are particularly relevant:
– Art. 6(1)(a) GDPR – your consent
– Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
– Art. 6(1)(c) GDPR – compliance with legal obligations (e.g., retention requirements under commercial and tax law)
– Art. 6(1)(f) GDPR – Protection of our legitimate interests, provided that your interests do not override ours
According to Section 25(1) of the TDDDG, information may only be stored on your device or accessed from information already stored there (e.g., cookies, local storage, pixels) with your consent, unless the process is absolutely necessary under Section 25(2) of the TDDDG to provide the service you have expressly requested (e.g., shopping cart, checkout, saving your cookie preferences).
3. Hosting, Website Provision, and Server Log Files
Our online store is operated on the Shopify e-commerce platform. The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides us with servers, a database, checkout functionality, and content delivery infrastructure, and in doing so processes all data that you enter in the store or that is generated during your use of the site as our data processor (Art. 28 GDPR). Shopify uses subprocessors, including its parent company, Shopify Inc. (Canada), as well as providers in the United States. An adequacy decision has been issued by the European Commission for Canada; transfers to the U.S. are made on the basis of the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.
To ensure fast and secure delivery of content, Shopify uses the content delivery and security network provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. This process involves the processing of your IP address. Cloudflare is certified under the EU-U.S. Data Privacy Framework.
When you visit our website, the following data is automatically recorded in server log files: IP address, date and time of access, page or file accessed, amount of data transferred, notification of successful retrieval, referrer URL, browser type and version, and operating system. This data is processed to deliver the website, ensure stability and security, and to defend against and investigate attacks and misuse. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in maintaining a secure and fully functional online store. The log data is stored by Shopify or Cloudflare only for as long as necessary for these purposes and is subsequently deleted or anonymized; we do not combine this data with other data sources for advertising purposes.
4. SSL or TLS Encryption
For security reasons, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" in the address bar and the lock icon in your browser. When encryption is active, the data you send to us cannot be read by third parties.
5. Cookies and Consent Management
We use cookies and similar technologies. We set strictly necessary cookies (e.g., for the shopping cart, checkout, language and currency selection, security, and saving your cookie preferences) based on Section 25(2) of the TDDDG and Article 6(1)(b) or (f) of the GDPR. All other cookies and technologies used for statistics, personalization, and marketing may only be used with your consent (Section 25(1) of the TDDDG, Article 6(1)(a) of the GDPR). Simply using the website does not constitute consent.
To obtain and manage your consent, we use the consent management app Pandectes GDPR Compliance (Pandectes P.C., Greece). Your selection, the date and time, and a consent ID are stored in the “_pandectes_gdpr” cookie for 12 months. The legal basis is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR (proof of consent).
You can revoke or change your consent at any time, effective for the future, by accessing the cookie settings again. You can also delete or block cookies in your browser; however, some features may then be unavailable.
6. Contact and Customer Service
If you contact us by email or through the contact form, we will process your information (e.g., name, email address, order number, content of the inquiry) in order to handle your inquiry. The legal basis is Article 6(1)(b) of the GDPR, provided your inquiry relates to a contract; otherwise, it is Article 6(1)(f) of the GDPR (legitimate interest in responding to inquiries).
To process customer inquiries, we use a help desk system with AI-powered support (Resolvia.ai). The content and metadata of your inquiry, as well as the associated order data, are processed to prepare responses and assign inquiries. The responses are reviewed by our team; no fully automated decisions with legal effect are made. The provider is bound as a data processor. We delete inquiries as soon as they have been fully processed and there are no legal retention requirements that prevent us from doing so.
7. Ordering and Contract Processing
When you place an order with us, we process the data necessary to fulfill your order: name, billing and shipping addresses, email address, phone number (if applicable), order and payment details, as well as information regarding returns and complaints. The legal basis for this is Article 6(1)(b) of the GDPR. Required fields are marked during the ordering process; without them, we cannot conclude the contract.
We retain documents relevant to commercial and tax law (e.g., invoices, accounting records) for six or eight years, in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) (Art. 6(1)(c) of the GDPR). We delete other contract data after the statutory warranty and statute of limitations periods have expired.
We send the order confirmation and other transaction emails (e.g., shipping confirmation) through Shopify.
8. Customer Account
You can create a customer account in the store. In doing so, we process the data you provide as well as your order history to give you access to your orders and enable you to place orders more quickly (Art. 6(1)(b) of the GDPR). You can have your customer account deleted at any time; statutory retention requirements remain unaffected.
9. Shipping, Storage, and Returns
For delivery purposes, we share your name, shipping address, and order details with our fulfillment service provider, which stores, packs, ships the goods, and accepts returns (VDS Fulfillment, Herzberg am Harz; warehouse management via software provided by Alaiko GmbH, Germany). Delivery is handled by Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, or its partners in the destination country. The legal basis is Article 6(1)(b) of the GDPR.
We will share your email address and, if applicable, your phone number with the shipping carrier so that it can notify you of the delivery date. The legal basis for this is Article 6(1)(f) of the GDPR; our legitimate interest lies in ensuring a smooth delivery. You may object to this at any time.
You can request returns through our returns portal, which is provided by Alaiko GmbH. For returns from Switzerland, we use the portal provided by exporto GmbH in Germany. The order and contact information required for the return will be processed (Art. 6(1)(b) GDPR).
10. Payment Service Providers
You enter your payment information directly with the respective payment service provider or during the Shopify checkout process; we do not receive any complete card details. The transfer of the data required for payment is based on Article 6(1)(b) of the GDPR. We offer the following payment service providers:
– Shopify Payments (credit and debit cards, Apple Pay, Google Pay, etc.): Payment processing is handled by Shopify and Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland.
– Shop Pay: Shopify International Limited (see Section 3). If you use Shop Pay, your data will also be stored in your Shop account.
– PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
– Klarna (e.g., invoice, installment plan, direct debit): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. When purchasing on account or in installments, Klarna conducts an identity and credit check to protect its legitimate interests and may use credit bureaus for this purpose; for more details, please see Klarna’s Privacy Policy.
– TWINT (Switzerland): TWINT AG, Stauffacherstrasse 31, 8004 Zurich, Switzerland. An adequacy decision has been issued by the European Commission for Switzerland.
On product pages and in the shopping cart, we display notifications from Klarna regarding payment options (on-site messaging). In doing so, your IP address is transmitted to Klarna; Klarna sets cookies only with your consent.
11. Newsletters and Email Marketing (Klaviyo)
When you sign up for our newsletter, we process your email address and, if applicable, your first name and date of birth to send you regular information about products, promotions, and new releases. Sign-up is done via a double opt-in process: You will receive an email asking you to confirm your subscription. We store the time and IP address of your registration and confirmation as proof. The legal basis is your consent (Art. 6(1)(a) GDPR).
We use Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA, for email delivery. Klaviyo is certified under the EU-U.S. Data Privacy Framework; in addition, we have entered into EU Standard Contractual Clauses. We track whether and when a newsletter is opened and which links are clicked in order to improve our content; this is part of your consent.
If you have already made a purchase from us, we may send you emails about our own similar products even without your separate consent (Section 7(3) of the German Unfair Competition Act (UWG), Article 6(1)(f) of the General Data Protection Regulation (GDPR)). You may object to this at any time.
You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in any email or by sending us a message. Your data will be deleted after you unsubscribe or added to a block list so that you no longer receive emails.
With your consent, Klaviyo also uses cookies on our website (e.g., “__kla_id,” valid for up to 2 years) to associate visits to the website with your newsletter profile (e.g., for shopping cart reminders). For information on the fonts loaded by Klaviyo’s sign-up forms, see Section 16.
12. Product Reviews
After you place an order, we’ll send you an email asking you to rate the products you purchased. We use the apps Loox (Loox Inc.) and Judge.me (Judge.me Ltd.) for this purpose. We base the rating request on Article 6(1)(f) of the GDPR (legitimate interest in customer feedback); you may object to this at any time. When you submit a review, we will publish it along with your first name or the name you have chosen and, if applicable, your photos (Article 6(1)(a) of the GDPR). The providers process the data as data processors; to the extent that data is transferred to third countries, this is done on the basis of adequacy decisions (e.g., Israel) or EU Standard Contractual Clauses.
13. Store Features via Apps
For certain features of our store, we use third-party apps integrated via Shopify. Unless cookies are required for these features or you have expressly requested the feature, the legal basis is Article 6(1)(b) or (f) of the GDPR; otherwise, it is your consent. The providers are bound as data processors.
– Translation: Weglot SAS, France – provides the language versions of our store; your IP address is processed in this process.
– Free items and promotions: BOGOS.io (Secomapp) – manages free items in the shopping cart; data transfers to third countries are based on EU Standard Contractual Clauses.
– Post-purchase upsells: Aftersell – displays complementary offers after checkout.
– Pre-orders and countdown timers: Essential Preorder and Essential Countdown Timer (Essential Apps).
– “Notify Me”: Kbite (Staqlab) – notifies you via email when a sold-out item becomes available again. For this purpose, we process your email address based on your consent and delete it after sending the notification or after 12 months.
– Landing pages: Replo, Inc., USA – page builder for individual promotional pages.
– Load time optimization: Hyperspeed – speeds up the loading of our pages.
– Product data feeds: Channable B.V., Netherlands, and Simprosys (Google Shopping Feed) – transmit product data to advertising and price comparison platforms; personal data of visitors is processed only within the scope of the conversion tracking described in Section 15.
14. Statistics and Analysis (only with consent)
We use the following services only if you consent to the “Statistics/Performance” category in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may withdraw your consent at any time.
– Shopify Analytics: Shopify tracks page views and interactions in the store to provide us with analytics (cookies, e.g., “_shopify_y” for up to 1 year, “_shopify_s” for 30 minutes).
– Google Analytics 4 and Google Tag Manager: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics creates pseudonymous usage profiles (page views, time spent on site, device information, approximate location); IP addresses are truncated within the EU. Google Tag Manager is used to manage website tags and does not process profiles itself. Cookies: “_ga,” “_ga_*” for up to 2 years. Data transfers to Google LLC in the U.S. are based on the EU-U.S. Data Privacy Framework.
– Microsoft Clarity: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records mouse movements, clicks, and scrolling behavior to create heat maps and anonymized session replays; entries in form fields are masked. Cookies: “_clck” up to 1 year, “_clsk” 1 day. Transfers to the U.S. are based on the EU-U.S. Data Privacy Framework.
– Hotjar: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St. Julian’s STJ 3141, Malta. Hotjar creates heat maps and session recordings; form entries are masked. Cookies “_hjSessionUser_*” up to 1 year, “_hjSession_*” for 30 minutes. The data is stored in the EU.
– Triple Whale: Triple Whale Inc., USA – aggregates data from our store and advertising channels to measure the success of our marketing efforts (attribution). Pseudonymous identifiers, page views, click sources, and order data are processed. Data is transferred to the U.S. based on EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
– A/B Testing and Personalization: Visually.io and conversion.io – test different versions of our pages and measure which ones perform better. Pseudonymous identifiers and usage data are processed; data is transferred to third countries based on EU Standard Contractual Clauses.
The analysis data is deleted as soon as it is no longer needed for evaluation, no later than 14 months after collection, unless a shorter retention period is specified in the settings for the respective service.
15. Marketing and Conversion Tracking (only with consent)
We use the following services only if you consent to the “Marketing” category in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). They are used to measure the effectiveness of our advertising and to display relevant ads to you on other websites and platforms. In doing so, pseudonymous identifiers, information about your device and browser, pages visited, shopping cart and purchase events, and—if you are logged in or placing an order—hashed contact data are transmitted to the providers. You can withdraw your consent at any time.
– Meta Pixel and Conversions API: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for the collection and transfer of data (Art. 26 GDPR); you can find the relevant agreement on Meta’s website under “Controller Addendum.” Meta is solely responsible for further processing. “_fbp” cookie: up to 3 months. Transfers to Meta Platforms, Inc. (U.S.) based on the EU-U.S. Data Privacy Framework.
– Google Ads, conversion tracking, and remarketing (including Google Marketing Platform/DoubleClick): Google Ireland Limited (see Section 14 for address). Cookies, e.g., “_gcl_au,” “_gcl_aw” for up to 3 months, “IDE” for up to 13 months. Transfers to the U.S. based on the EU-U.S. Data Privacy Framework.
– Pinterest Tag: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. “_pin_unauth” cookie for up to 1 year. Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework.
– Taboola: Taboola Europe Limited or Taboola, Inc., U.S. – Measurement and delivery of ads in recommendation networks on news and content sites. Data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.
– Microsoft Advertising: Microsoft Ireland Operations Limited (see Section 14 for address) – Conversion tracking for ads in Bing Search. “MUID” cookie valid for up to 1 year.
– Sovendus: Sovendus GmbH, Hermann-Veit-Straße 6, 76135 Karlsruhe – After you place your order, we’ll show you a coupon offer from partner companies on the order confirmation page. Hashed, pseudonymized data (e.g., order number, order value, timestamp) is transmitted in this process. Only if you actively select an offer will your title, name, and email address be transmitted to Sovendus.
– RetentionX: Analysis of purchase and customer data to optimize customer retention and advertising spend.
– Klaviyo Onsite Tracking: see Section 11.
Advertising cookies are deleted no later than the expiration periods specified above.
16. Fonts
The fonts used in our store's design are loaded via the Shopify CDN or from our own servers; no connection to Google's servers is established for this purpose.
Our newsletter sign-up forms (Klaviyo, see Section 11) may load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In doing so, your IP address is transmitted to Google; transmission to the United States cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), provided that the forms are loaded only after consent is given; otherwise, it is our legitimate interest in a uniform presentation (Art. 6(1)(f) GDPR). We are working on integrating these fonts locally as well.
17. Social Media Presence
We maintain profiles on Instagram, Facebook, and TikTok. When you visit these profiles, the platform operators process your data in accordance with their own privacy policies. We are jointly responsible with Meta for analyzing page statistics (Insights) (Art. 26 GDPR). On our website, we merely provide links to these profiles; simply visiting our website does not result in any data being transmitted to these networks.
18. Data Transfers to Third Countries
Some of the providers listed are based outside the EU or the EEA, or transfer data to those regions. We transfer data only if the European Commission has issued an adequacy decision for the country in question (e.g., Canada, Switzerland, Israel, the United Kingdom, or—for certified companies—the U.S. under the EU-U.S. Data Privacy Framework of July 10, 2023) or if appropriate safeguards under Article 46 of the GDPR are in place, in particular the EU Standard Contractual Clauses. You can check the certification status of U.S. companies at dataprivacyframework.gov.
19. Retention Period
Unless a specific retention period is specified in this Privacy Policy, we store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. After that, the data is deleted or, if deletion is not possible due to statutory retention obligations, its processing is restricted.
20. Your Rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to withdraw your consent at any time with future effect (Art. 7(3) GDPR). To exercise these rights, simply contact kontakt@makani-germany.de.
Right to Object: If we process your data based on Article 6(1)(f) of the GDPR, you may object at any time on grounds relating to your particular situation (Article 21(1) of the GDPR). You may object at any time to processing for direct marketing purposes without providing a reason (Article 21(2) of the GDPR).
You also have the right to file a complaint with a data protection supervisory authority. The supervisory authority with jurisdiction over us is the State Data Protection Commissioner of Lower Saxony (LfD), Prinzenstraße 5, 30159 Hannover.
21. Automated Decisions
We do not make any decisions based solely on automated processing within the meaning of Article 22 of the GDPR. When purchasing on account or in installments through Klarna, Klarna determines whether this payment method is offered based on an automated credit check; you can then choose a different payment method and contact Klarna for details.
22. Changes
We will update this Privacy Policy if the services we use or the legal situation changes. The version currently published here is the one that applies.