Privacy policy
Privacy Policy (Datenschutzerklärung)
This policy explains what personal data we process when you visit yunexa.com, place an order, or contact us — and on what legal basis, for how long, and what rights you have.
1. Controller
The controller within the meaning of Art. 4 (7) GDPR is:
Dr. Babak Kamel
Core Tradex Company (CT CO.)
Alsterkrugchaussee 577 b
22335 Hamburg, Germany
Email: service@yunexa.com
Phone: +49 40 21065056
We are not required to appoint a Data Protection Officer. Please direct all data protection enquiries to the address above.
2. Visiting Our Website
2.1 Server log data
When you visit our website, our hosting provider automatically records technical data: your IP address, the date and time of access, the page requested, the referring page, your browser type and version, and your operating system.
Purpose: to deliver the website, ensure stability and detect attacks.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure and functional website.
Retention: generally 30 days, longer only where a specific security incident requires it.
2.2 Cookies and similar technologies
We use cookies that are technically necessary to operate the shop — for example to keep your shopping cart, remember your language, and secure the checkout. These are set without your consent on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.
Any cookie that is not technically necessary — in particular for statistics or marketing — is set only after you have given consent in our cookie banner, on the basis of § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You can change or withdraw your choice at any time through the cookie settings on our website. Withdrawal does not affect the lawfulness of processing carried out before it.
3. Your Design Files and Personalisation Data
This is the processing that is most specific to what we do, so we explain it in detail.
3.1 What we receive
When you use our product configurator, we process:
- Files you upload — photographs, artwork, logos or other images.
- Text you enter — names, dates, messages or other wording to be printed.
- Configuration data — the garment, colour, size, print areas, and the position and scale of your design.
- A preview image generated from your configuration.
- Your confirmation — the fact that you ticked the confirmation box, the exact wording you confirmed, the time, and a unique identifier for that configuration.
⚠ Please note that files you upload may themselves contain personal data — for example photographs of you, your family or other people, or names and dates. If your file contains a photograph of another person, you are responsible for having their agreement to have it printed.
Photographs can also contain special categories of personal data within the meaning of Art. 9 GDPR, for example where they reveal health, religious belief or ethnic origin. We do not seek such data and do not evaluate your images for it. Where you upload such content, you do so on your own initiative and we process it only to produce your order.
3.2 Why we process it
| Purpose | Legal basis |
|---|---|
| Producing the item you ordered | Art. 6 (1) (b) GDPR — performance of the contract |
| Showing you a live preview before you order | Art. 6 (1) (b) GDPR — pre-contractual steps at your request |
| Checking print quality and resolution | Art. 6 (1) (b) GDPR |
| Recording your confirmation as evidence | Art. 6 (1) (c) and (f) GDPR — legal obligations and our legitimate interest in being able to prove what was agreed |
| Handling complaints and warranty claims | Art. 6 (1) (b) and (f) GDPR |
| Enabling you to re-order the same design | Art. 6 (1) (f) GDPR — legitimate interest in customer service; you may object at any time |
3.3 How long we keep it
- Uploaded files and print-ready artwork: 6 months after delivery, then deleted. This period covers re-orders and early complaints.
- Configuration data, preview image and your confirmation: kept with the order record. These form part of our commercial documentation and are retained for the statutory periods described in section 9.
- If you ask us to delete your files earlier, we will do so, unless we still need them to defend a pending complaint.
3.4 Background removal
Where you use the background-removal function, the processing runs in your own browser. Your image is not sent to us or to a third party for that purpose. The software module is loaded from a content delivery network, which receives your IP address as a technical necessity of delivering the file.
4. Placing an Order
To process your order we need your name, billing and delivery address, email address, and your order and payment details.
Legal basis: Art. 6 (1) (b) GDPR for performing the contract; Art. 6 (1) (c) GDPR for the tax and commercial law retention obligations described in section 9.
We pass your data to the parties who need it to complete your order: our payment provider, our shipping carrier, and our tax adviser.
5. Payment
Payments are processed by our payment service providers. Depending on the method you choose, your payment data is transmitted directly to the relevant provider. We do not receive or store your full card number.
Legal basis: Art. 6 (1) (b) GDPR. Where a provider carries out a credit or fraud check, that provider is responsible for it and acts on the basis of its own legitimate interest under Art. 6 (1) (f) GDPR.
The providers currently available to you are shown in our checkout, each with its own privacy policy.
6. Shipping
We pass your name, delivery address and — where you have provided it for delivery notifications — your email address or phone number to our shipping carrier.
Legal basis: Art. 6 (1) (b) GDPR.
7. Customer Account, Contact and Email
7.1 Customer account
You can order as a guest. If you choose to create an account, we store the details you enter so that you can see your orders and check out more quickly. You can delete your account at any time; order records that we are legally required to keep are retained as described in section 9.
Legal basis: Art. 6 (1) (b) GDPR.
7.2 When you contact us
If you write or call us, we process your message and contact details to answer you. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete enquiries once they are settled and no retention obligation applies — normally within 12 months.
7.3 Transactional emails
We send you order confirmations, dispatch notices and similar messages. These are necessary to perform the contract and are not marketing. Legal basis: Art. 6 (1) (b) GDPR.
7.4 Newsletter
If you subscribe to our newsletter, we use the double opt-in procedure: you receive a confirmation email and are only added to the list once you click the link. We log the time of subscription and confirmation in order to prove your consent.
Legal basis: Art. 6 (1) (a) GDPR. You can unsubscribe at any time using the link in every newsletter, with effect for the future.
8. Recipients of Your Data
We only pass on personal data where this is necessary. Our processors act on our instructions under a data processing agreement in accordance with Art. 28 GDPR.
| Category | Purpose |
|---|---|
| Shopify — shop platform and hosting | Operating the shop, storing order data |
| Payment service providers | Processing your payment |
| Shipping carrier | Delivering your order |
| Email service | Sending order and service emails |
| Tax adviser | Bookkeeping and tax obligations |
| Content delivery network | Delivering fonts, scripts and images |
Beyond this we disclose data only where we are legally obliged to, or to establish, exercise or defend legal claims.
8.1 Shopify
Our shop runs on the Shopify platform. Shopify processes data on our behalf in order to provide the shop. The data storage location for our store is the European Union. Shopify additionally processes certain data as an independent controller for its own platform purposes; details are set out in Shopify's own privacy documentation.
9. How Long We Keep Data
| Data | Period | Reason |
|---|---|---|
| Server logs | 30 days | Security |
| Uploaded design files | 6 months after delivery | Re-orders, complaints |
| Invoices and accounting records | 10 years | § 147 AO, § 257 HGB |
| Order data and your confirmation | 10 years | Commercial documentation |
| Contact enquiries | Up to 12 months | Until settled |
| Newsletter consent records | Until you unsubscribe, plus 3 years | Proof of consent |
| Customer account | Until you delete it | Your choice |
The statutory retention periods run from the end of the calendar year in which the transaction took place. During the retention period, data is restricted from further processing and used only to meet the legal obligation.
10. Transfers Outside the EU
Our store data is hosted in the European Union. Some of our service providers are nevertheless based in third countries, or have parent companies there. Where personal data is transferred outside the EU or EEA, we rely on an adequacy decision of the European Commission, or on the European Commission's Standard Contractual Clauses together with supplementary measures where required.
You may request a copy of the safeguards in place by writing to us.
11. Your Rights
You have the following rights in respect of your personal data:
- Access (Art. 15 GDPR) — to find out what data we hold about you and to receive a copy.
- Rectification (Art. 16 GDPR) — to have inaccurate data corrected.
- Erasure (Art. 17 GDPR) — to have your data deleted, where no retention obligation applies.
- Restriction (Art. 18 GDPR) — to have processing limited in certain circumstances.
- Data portability (Art. 20 GDPR) — to receive your data in a structured, machine-readable format.
- Withdrawal of consent (Art. 7 (3) GDPR) — at any time, with effect for the future.
Right to object — Art. 21 GDPR
Where we process your data on the basis of a legitimate interest under Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where we process your data for direct marketing, you may object at any time without giving reasons. We will then stop using your data for that purpose.
To exercise any of these rights, write to service@yunexa.com. We may need to verify your identity first. We respond within one month; where a request is complex we may extend this by two further months and will tell you if we do.
12. Right to Lodge a Complaint
If you believe we are processing your data unlawfully, you have the right to complain to a supervisory authority — in particular in the Member State of your residence, your place of work, or the place of the alleged infringement.
The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 7. OG
20459 Hamburg, Germany
datenschutz-hamburg.de
13. Is Providing Data Required?
You are not obliged to provide personal data. However, we need certain data to conclude and perform a contract with you — your name, delivery address and payment details, and the design data needed to produce your item. Without these we cannot process your order.
14. Automated Decision-Making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
15. Data Security
Our website uses TLS encryption. You can recognise an encrypted connection by the padlock in your browser's address bar. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
16. Changes to This Policy
We update this policy when our processing or the legal position changes. The current version always applies and is available on this page.