Privacy policy
Last updated: 1 November 2026
1. Controller and contact details
The controller responsible for the processing by Magic Candles described below is:
Anton Maslun, trading as MAGIC CANDLES
c/o IP-Management #6530
Ludwig-Erhard-Straße 18
20459 Hamburg, Germany
Telephone: +49 176 31034407
Email: info@magic-candles.de
This notice covers our online shop, the ordering and fulfilment of our products, our profiles on Facebook, Instagram and TikTok, and your communications with us. For services that process data for their own purposes, you will also find links to the respective privacy notices.
2. The data we process
Depending on how you use our services, we process contact details such as your name, email address and telephone number, billing and delivery addresses, account and order data, shopping cart contents, payment method and payment status, information about vouchers, returns and refunds, the contents of your messages and reviews, and technical usage data. Technical data includes, in particular, your IP address, browser and device, pages visited, times and events such as a shopping cart or order transaction, and cookie identifiers and similar identifiers.
We receive data directly from you, when you use the shop, and from service providers involved in payments, shipping, returns and shop operations. You are under no legal obligation to use our shop or provide us with optional information. However, we need information required for an order, payment, delivery or the handling of your enquiry to provide the service you request. Without this information, it may not be possible to provide the relevant service. Optional information is identified in the relevant input field.
3. Legal bases
We process data necessary to take steps prior to entering into a contract and to perform a contract, including orders, payments, deliveries, returns and customer service, under Article 6(1)(b) GDPR. We fulfil legal obligations, particularly retention obligations under tax and commercial law, on the basis of Article 6(1)(c) GDPR. Article 6(1)(f) GDPR is the basis for operating the shop securely, preventing abuse, handling general enquiries, and establishing or defending legal claims; our respective legitimate interests are the security of our systems, reliable communications and the protection of our rights.
Article 6(1)(a) GDPR is the legal basis for advertising, analytics and personalisation that require consent. The storage of information on your device or access to that information is additionally governed by Section 25 TDDDG: access that is not strictly necessary requires consent; Section 25(2) TDDDG applies to functions that are strictly necessary for the service you request. The legal basis for processing personal data must be assessed separately.
4. Shopify: shop operations, customer accounts and security
Our shop is operated using Shopify. The contact for the processing of data from the European Economic Area is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Shopify processes, on our behalf, technical access and device data, shopping cart, contact, account, order and payment status data, among other information, to provide the shop, checkout, customer accounts and order fulfilment and to protect them against abuse. The Shopify Data Processing Addendum applies to processing on our behalf.
The necessary processing is based on Article 6(1)(b) GDPR where it serves your requested use or a contract, and on Article 6(1)(f) GDPR for secure and reliable operation. Shopify uses affiliated companies and subprocessors. The hosting region shown for our shop is the United States. Further international processing, for example in Canada, is possible. Details can be found in the section on international transfers and in the Shopify Privacy Policy.
If you use a customer account or Shop Pay, the information required to sign in, associate your orders with your account and manage the functions you select will be processed. Shop Pay and a personal Shop account may also establish a separate relationship between you and Shopify.
5. Shopify Network Intelligence and enhanced services
Shopify Network Intelligence is enabled for our shop. Shopify may combine data from your interactions and transactions with our shop with information from your use of other merchants and Shopify services. The enhanced services are used for purposes including analytics, personalisation, improvements to products and services, and advertising. Shopify processes data for these enhanced services as a controller in its own right; the Shopify Consumer Privacy Policy applies.
In the European Economic Area, your consent is required for personalised advertising based on your behaviour with us, other merchants and Shopify. Information about your rights in relation to Shopify, particularly the withdrawal of consent and objections, can be found in the Shopify Privacy Portal. You can also manage your choices for our shop through the cookie settings.
6. Cookies, consent and your settings
The shop uses cookies and similar technologies for the shopping cart, sign-in, security and storage of your privacy choices, as well as for the analytics and marketing functions described below. You can change your choices through the cookie banner and the Cookie settings link. You can withdraw consent you have given at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
To manage and demonstrate your choices, we may store, in particular, your consent status, the time, browser or device information, and an associated identifier. This serves to fulfil data protection obligations to demonstrate compliance and to ensure the reliable operation of consent management (Article 6(1)(c) and (f) GDPR). You can also delete or restrict stored cookies in your browser. This may affect shop functions you wish to use.
7. Orders, shipping, returns and accounting
To fulfil your order, we process, in particular, your contact and address details, the items ordered, the invoice amount, payment status, and shipping, return and refund data. We use Billbee GmbH, Arolser Straße 10, 34477 Twistetal, Germany, for order and document management; for accounting, we use Lexware Office provided by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. The providers process the data required for their respective tasks. The legal bases are Article 6(1)(b) and (c) GDPR. Further information: Billbee and Lexware Office.
For warehousing, shipping and returns services, Meier Logistik GmbH, Bellinostraße 15, 72108 Rottenburg am Neckar, Germany, receives the necessary order, recipient, delivery and return data. Returns for Magic Candles are received at Roseckstrasse 19, 72108 Rottenburg am Neckar – Seebronn. Transport companies commissioned to carry the goods receive the data required for delivery and shipment tracking. The legal basis is Article 6(1)(b) GDPR. The transfer described here serves to handle delivery and returns. Meier Logistik privacy information.
Tax advisers, legal advisers, banks and competent authorities may also receive data where this is necessary to fulfil legal obligations or handle claims. This is based on the relevant legal obligation or our legitimate interest in proper business management and the pursuit of legal claims.
Electronic withdrawal function
We use the “EU-Widerrufsbutton” service provided by CC Consulting GmbH, Emil-Figge-Straße 91, 44227 Dortmund, Germany, for our electronic withdrawal function. The data processed include your name, email address, the order or contract details needed to identify the transaction, including any affected items, your withdrawal declaration and the date and time it was received. Technical connection data necessary to access and provide the function are also processed.
CC Consulting GmbH processes the necessary data as our processor to receive and document your withdrawal declaration and send the acknowledgement of receipt. The legal basis for the statutory withdrawal function and acknowledgement of receipt is Article 6(1)(c) GDPR in conjunction with section 356a of the German Civil Code. Where we subsequently use the submitted information to handle the contract concerned and this is necessary for that purpose, the processing is based on Article 6(1)(b) GDPR.
The retention period is determined by the processing and documentation necessary for the withdrawal and any applicable statutory retention obligations.
8. Payment methods
When you make a payment, the information required for the selected payment method is transmitted to the payment service provider involved, including, in particular, the amount, currency, order reference, contact and billing details, and payment and technical security data. We receive information about the success, status or reversal of the payment. Processing for payments and refunds is based on Article 6(1)(b) GDPR; legal obligations and fraud prevention may provide further legal bases for the respective provider.
- Shopify Payments and Shop Pay: Shopify International Limited provides the payment integration. Payments are processed with the payment service providers used for the respective payment method. Shopify lists these in its current list of payment service providers. Where they act on our behalf, the data processing terms apply; payment service providers may act as controllers in their own right for their own regulatory obligations and certain other purposes. Shopify privacy information.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes data for payment processing and, as a controller in its own right, for purposes including fraud prevention and compliance with regulatory obligations. PayPal Privacy Statement.
- Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Depending on the Klarna product selected, Klarna may carry out identity, fraud and credit checks, in particular. These may involve automated decisions about the availability of a Klarna payment method. Klarna provides details about the data, checks and your rights.
- Apple Pay: If you use your Apple Wallet, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, your card provider and the payment service providers involved in processing the payment are included. Apple Pay & Privacy.
- Google Pay: According to Google's payments privacy notice, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for processing European consumer data. Your card provider and the payment processor are also involved. Google Payments Privacy Notice.
The checkout shows which payment methods are available to you. Any additional processing by a payment provider for its own purposes is governed by its privacy notice; this also contains information about credit reference agencies, retention and international transfers.
9. Contact by email, form, telephone and WhatsApp
When you contact us, we process your contact details, the contents of your enquiry and, where applicable, order references. Article 6(1)(b) GDPR applies to contract-related enquiries; Article 6(1)(f) GDPR applies to other enquiries, based on our interest in appropriate communications. We use IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, for our email infrastructure. IONOS privacy notice.
If you choose to communicate with us through WhatsApp, we process your telephone number, your visible profile and the content you send to handle your enquiry. WhatsApp is an optional contact channel; you can use email or telephone instead. The provider in the European Economic Area is WhatsApp Ireland Limited. WhatsApp also processes usage and connection data, in particular, for its own purposes and within its international infrastructure. Information about this and about transfers to affiliated companies can be found in the WhatsApp Privacy Policy. Please do not send confidential payment information or sensitive data that is unnecessary for your enquiry through this contact channel.
The AI-powered Meta Business Agent is also integrated into new WhatsApp chats. Responses may be generated automatically. For this purpose, the service processes the messages you send and the information required for the conversation. This serves to handle your product and service enquiries. You can contact us by email or telephone at any time to have your enquiry handled personally. The processing of your enquiry is governed by the legal bases for contact enquiries stated above; any further processing that requires consent needs separate consent. Information about the service can be found in the WhatsApp Help Centre article about Meta Business Agent and the terms linked there.
10. Newsletters and product-related messages
We use Shopify Messaging for newsletters and marketing messages. The data processed includes, in particular, your email address, subscription status, interests you have selected and, where applicable, product or shopping cart information relevant to the message concerned. The shop also supports product-related notifications, such as alerts about items being back in stock or price changes, and reminders about incomplete purchases.
Your consent under Article 6(1)(a) GDPR is the basis for promotional messages and performance measurement linked to an identifiable individual. Where legally permitted marketing to existing customers takes place under Section 7(3) UWG, Article 6(1)(f) GDPR is the basis; you can object to this use at any time. Placing an order alone does not constitute general consent to newsletters. You can unsubscribe using the unsubscribe link in a marketing message or by contacting us. Necessary order, shipping and service communications are separate from this and are based on contract performance.
11. Reviews with Judge.me
Judge.me Ltd, c/o Buckworths, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom, is integrated for product reviews. To manage and display a review you submit, the data processed may include, in particular, your name or display name, email address, review text, star rating, submitted media, and product and order references. The review information intended for publication is publicly visible; your order or payment data is not.
A review you voluntarily submit is published on the basis of your consent; checks for authenticity and abuse are based on our legitimate interest in reliable reviews. Promotional review requests and usage analytics that require consent need a separate valid legal basis. The technical integration also includes a Judge.me pixel for storefront events. Where this is used to analyse page views, shopping cart actions or other usage behaviour, the consent requirements described under cookies and analytics apply. Judge.me generally processes the buyer and review data we transmit on our behalf and may act as a controller in its own right for its own direct user relationships. Judge.me privacy notice.
12. Meta, Google and TikTok: measurement and marketing
The following integrations are included in the shop to capture customer events. Possible events include page and product views, shopping cart actions, the start of checkout and purchases. These can be used to analyse the source of visits, the effectiveness of product advertisements and the attribution of purchases, and to create audiences for personalised advertising. Depending on the function and choices made, the data processed includes, in particular, page/product information, event times, order value, IP address, device information and online identifiers. Your consent is the legal basis for such analytics involving personal data or personalised advertising and for device access that is not necessary (Article 6(1)(a) GDPR and Section 25(1) TDDDG).
- Facebook and Instagram / Meta: Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland. The integration supports browser-side transmission through the Meta pixel and server-side transmission through the Conversions API. This may also involve processing order events and contact details intended for matching. Meta may associate events with a Meta account and use them for measurement and personalisation. Meta Privacy Policy and Meta Business Tools Terms.
- Google & YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The integration can measure events relating to Google advertisements and free product listings and attribute purchases. Google acts as an independent controller for regular Google Ads processing; data processing terms apply to certain separate services. This integration does not automatically mean that all Google services are used. Google Privacy Policy and Data use on partner sites.
- TikTok: The TikTok web integration is used to transmit events for measurement and marketing. For users in the European Economic Area, TikTok's privacy notice identifies TikTok Technology Limited, 10 Earlsfort Terrace, Dublin D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom. TikTok may use events for matching to users and personalising advertising. TikTok privacy notice and Business Products Terms.
For Meta, joint controllership under Article 26 GDPR extends to the collection of the relevant event data through the Business Tools and its transmission to Meta for the jointly determined purposes. Meta is independently responsible for subsequent processing. The supplementary agreement is available in the Meta Controller Addendum. We inform you about the integration into our shop and are responsible for the necessary legal basis for our processing. Regardless of the internal allocation of responsibilities, you can exercise your data protection rights against both us and Meta. Further details about the data processed by Meta and how to contact its Data Protection Officer can be found in the Meta Privacy Policy.
Depending on the function, the providers also process data for their own purposes. Where collection and transmission are subject to joint controllership, the allocation of responsibilities is governed by the respective supplementary joint controller agreements. The provider's privacy notice applies to its further processing and the settings available there. You can manage your choices for our shop through the cookie settings; you can also use the settings in your respective platform account.
12a. Our Facebook Page and Page Insights
We operate the Magic Candles Facebook Page to present our business and products, share content and communicate with interested individuals and customers. The contact details in section 1 apply to processing for which we are responsible. In the European Economic Area, the platform is provided by Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland.
Communications and public interactions
If you comment on our posts, react to content or contact us through Messenger, we process the information visible to us, particularly your profile name, publicly available profile information, your posts or messages and the associated times. This serves to answer enquiries, discuss our products and moderate our Page. We handle contract-related enquiries under Article 6(1)(b) GDPR; other communications and moderation are based on Article 6(1)(f) GDPR. Our legitimate interests are accessible customer communications, presenting our business and maintaining constructive discussions protected against abuse. Other people may also see public comments and reactions. Please do not post order details or confidential information in public comments. You can contact us by email or telephone instead.
Page statistics and joint controllership
Meta provides Page administrators with aggregated statistics about visits and interactions (Page Insights). To do this, Meta processes events such as Page and post views, reactions and clicks. Depending on usage, this involves processing profile, device and usage information. We receive the aggregated statistics, not the personal event records from which Meta creates them.
For the processing of personal data to create Insights events and combine them into Page Insights, we and Meta are joint controllers under Article 26 GDPR. The Page Insights Controller Addendum describes the allocation of responsibilities. Under this agreement, Meta assumes primary responsibility in particular for providing information about this processing and handling the corresponding data subject rights. Meta provides further details in its Information about Page Insights. Regardless of this allocation, you may also exercise your rights against us.
We use the statistics provided to understand the reach of our content and interest in it, and to improve the information we offer. This is our legitimate interest under Article 6(1)(f) GDPR. This does not replace consent where consent is required for a particular processing operation or access to information on a device. Our online shop's consent and cookie settings do not control processing within Facebook; use the settings provided by Facebook or your Meta account for that purpose.
Processing by Meta, retention and your rights
Meta also processes data for its own purposes, for example to provide and personalise its services and for advertising. Data may be associated with your Meta account and processed outside the European Economic Area, particularly in the United States. The Meta Privacy Policy provides details about data types, legal bases, recipients, retention periods, transfer safeguards, settings and Meta's privacy contact. Our information about international transfers in section 13 also applies.
The retention principles in section 14 apply to enquiries we handle and any records we retain. Content on Facebook remains available within the platform's functionality until removed by you, us or Meta; removing content from our Page view does not necessarily delete all data held by Meta. Meta's own information governs its further retention. The rights described in section 15, particularly access, erasure, complaints and objections to processing based on legitimate interests, also apply here. Please send requests to us at info@magic-candles.de; where necessary, we forward requests concerning jointly controlled Insights data to Meta.
12b. Our Instagram profile
We operate the public Instagram profile @magic_candles.official to present Magic Candles and our products and to communicate with interested individuals and customers. The owner identified in section 1 is responsible for our own processing. Meta Platforms Ireland Limited (Ireland) is the provider of Instagram in the European Economic Area and is responsible for its platform processing. Meta’s privacy contact details are available in the Privacy Policy linked below.
Contact, comments and interactions
If you interact with our profile or send us a direct message, we process the information visible to us, particularly your profile name, profile information, comments, reactions, messages and associated times. We use this information to answer enquiries, discuss our products and moderate content. Article 6(1)(b) GDPR applies to contract-related enquiries. Other communications, presentation of our business and moderation are based on Article 6(1)(f) GDPR; our legitimate interests are accessible customer communications and constructive discussions protected against abuse. Other people may see your public interactions. Please do not include order details or confidential information in public comments. You can contact us by email or telephone instead.
Statistics and processing by Meta
Where Meta provides Instagram Insights for our profile, we receive aggregated information about reach and interactions with our content. We use these reports to improve the information we offer; this is our legitimate interest under Article 6(1)(f) GDPR. This does not replace consent where required for particular processing operations or access to information on a device. Meta provides further information under Instagram Insights. The Facebook Page Insights Controller Addendum described in section 12a concerns Facebook Pages; it is not applied here indiscriminately to all Instagram features.
Meta also processes data for its own platform purposes. The Instagram Privacy Policy explains data types, legal bases, recipients, retention, possible processing outside the European Economic Area and privacy contacts. Our shop's cookie settings do not control processing within Instagram; use your Instagram or Meta account settings for this purpose. Sections 14 and 15 govern our own retention periods and your rights; see section 13 for international transfers. You can contact us at info@magic-candles.de. Removing content from our profile or messages does not necessarily delete all data held by Meta.
12c. Our TikTok profile
We operate the public TikTok profile @magic_candles.official to present Magic Candles and our products and to communicate with interested individuals and customers. The contact details in section 1 apply to our own processing. For its platform processing in the European Economic Area, TikTok identifies TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited (United Kingdom) as joint controllers.
Contact, comments and interactions
For comments, reactions and direct messages, we process the profile details, communication content and times visible to us to answer enquiries and moderate our profile. Contract-related communications are processed under Article 6(1)(b) GDPR; other communications and moderation under Article 6(1)(f) GDPR. Our legitimate interests are accessible customer communications, presenting our products and preventing abuse. Other people may see public interactions. Please do not post confidential information in comments; email and telephone are alternative contact channels.
TikTok Analytics
Where TikTok provides Analytics for our profile, we receive aggregated, anonymous statistics about views and interactions. Analytics does not give us access to the personal engagement data from which TikTok creates these statistics. Publicly visible comments and messages sent directly to us are separate from these reports. We use these statistics to improve our content based on our legitimate interest under Article 6(1)(f) GDPR. Where our content triggers the creation of personal engagement data for Analytics and we jointly determine the purposes and means of that processing with TikTok, this processing is subject to joint controllership under Article 26 GDPR. This concerns the creation and collection of engagement data and its aggregation into Analytics, rather than automatically covering all further processing by TikTok.
The TikTok Analytics Joint Controller Addendum and Information about TikTok Analytics explain the allocation of responsibilities. Under these arrangements, TikTok is responsible in particular for providing information about the relevant processing and handling the associated data subject rights. You may also exercise your rights against us. These arrangements and our legitimate interest do not replace any consent that is required.
Platform processing, retention and your rights
TikTok also processes data for its own platform purposes. This may involve processing outside the European Economic Area. The TikTok Privacy Policy explains recipients, countries, transfer safeguards, legal bases, retention and privacy contacts. Our shop's cookie settings do not apply within TikTok. Section 14 and the rights in section 15 apply to our own records; please send requests to info@magic-candles.de. Removing content from our profile does not necessarily delete all data held by TikTok.
13. International transfers
Shopify and the payment, communications, review and marketing providers named above may process personal data outside the European Economic Area, particularly in the United States, Canada and the United Kingdom. Depending on the recipient and the processing, international transfers are based on adequacy decisions under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, particularly the European Commission's Standard Contractual Clauses. A US recipient is covered by the EU–US Data Privacy Framework only if it holds valid certification for the processing concerned; this does not apply to all the named providers across the board.
Shopify describes transfers to Canada based on the relevant adequacy decision and further transfers within its group or to subprocessors using contractual safeguards. Shopify: international transfers. Information about other recipients and safeguards can be found in the linked provider notices. You can also ask us for information about the safeguards applicable to a particular transfer and for a copy of, or access to, those safeguards.
14. Retention periods
We store data only for as long as it is necessary for the relevant purpose or a legal retention obligation applies. Depending on the type of document, order and invoice records are subject, in particular, to retention periods of six, eight or ten years; the standard tax retention period for accounting records is eight years. The start of these periods and any possible extensions are governed by statutory provisions. Data for establishing or defending legal claims may be needed until the applicable limitation period expires or proceedings are concluded.
General enquiries are deleted once they have been fully dealt with, unless there are reasons for retaining them. Account data remains necessary for the duration of the account; after the account is closed, only data with a separate reason for retention is retained. Marketing data is processed until consent is withdrawn, an objection is made or the purpose no longer applies; necessary records and suppression entries may subsequently be retained to respect your decision and defend legal claims. The lifetimes of technical identifiers and retention periods for provider data depend on the relevant function and the provider's information. Withdrawal of consent or deletion of an account does not result in the deletion of documents that must be retained by law.
15. Your rights
Subject to the GDPR, you have the rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future. To exercise your rights, simply send a message to info@magic-candles.de. If there are reasonable doubts about your identity, we may request the additional information necessary to clarify it.
Right to object: Where processing is based on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time without giving a specific reason.
You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, your place of work or the place of the alleged infringement. An overview of the authorities is available from the European Data Protection Board. You may also exercise rights directly with a provider acting as an independent controller.
The marketing functions described may create profiles to assess your interests. For a payment method you select, credit and fraud checks carried out by a payment service provider, in particular, may lead to automated decisions about the availability of that payment method. The respective payment service provider explains the relevant criteria, effects and rights in its privacy notice.
16. Changes to this notice
We update this notice when our processing, the services we use or legal requirements change. The version published here, with the date stated above, is the applicable version.