Privacy policy

English translation for your convenience. The German version is legally authoritative.

Privacy policy

1. Controller
BeVain Jewelry, proprietor Michelle Eitel, Ahornstr. 11, 82041 Oberhaching, Germany
Phone: +49 152 31965102, email: info@bevain.de
Please send any data protection enquiries to info@bevain.de.

2. Overview and legal bases
We process personal data to the extent necessary to operate this online shop, process your order and communicate with you, and for analytics and advertising only if you have given your consent. The legal bases are Art. 6(1)(a) GDPR (consent), point (b) (contract and pre-contractual measures), point (c) (legal obligations) and point (f) (legitimate interests). In addition, § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) applies to the storage of information on, and the reading of information from, your terminal device.

3. Hosting and shop system
Our shop runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify processes the data arising in the shop on our behalf, including order and customer data. Data may be transferred to Shopify Inc. in Canada and to affiliated companies in the USA. For Canada, there is an adequacy decision of the European Commission; for the USA, we rely on the EU-US Data Privacy Framework or standard contractual clauses. Legal basis: Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in the secure and reliable operation of the shop.

4. Server log files
When you access the website, technically necessary data is processed (IP address, date and time, page accessed, referrer, browser, operating system) in order to deliver the website and fend off attacks. Legal basis: Art. 6(1)(f) GDPR.

5. Cookies and consent
We set technically necessary cookies, for example for the shopping basket, checkout, language settings and security, on the basis of § 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. We only set all other cookies and comparable technologies for analytics and marketing with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You give it via our cookie banner and can withdraw or change it there at any time with effect for the future, including via the “Cookie settings” link in the footer of every page.

We operate the cookie banner using Complianz by Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, the Netherlands. Complianz stores your choice in a cookie on your device and logs the consent as proof. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and § 25(2) TDDDG.

6. Orders and performance of the contract
For your order, we process your name, billing and delivery address, email address, telephone number where applicable, and order and payment information. The legal basis is Art. 6(1)(b) GDPR. We retain documents relevant under commercial and tax law for the statutory periods, generally eight to ten years (Art. 6(1)(c) GDPR).

7. Payment service providers
Depending on the payment method you choose, we pass the data required for payment to the relevant provider, for example to Shopify Payments (processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, or Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. The providers process data partly under their own responsibility, for example for fraud prevention. For Klarna payment methods such as invoice or instalment purchase, Klarna may carry out an identity and credit check; details can be found in Klarna's privacy notice. Legal basis: Art. 6(1)(b) GDPR; for fraud prevention and credit checks by the provider, Art. 6(1)(f) GDPR.

8. Shipping
For delivery, we transmit your name and delivery address to the shipping company we have engaged, currently DHL (Deutsche Post AG or DHL Express Germany GmbH, Bonn); legal basis Art. 6(1)(b) GDPR. We pass on your email address and telephone number so that the carrier can announce and coordinate the delivery; for insured valuable shipments, this is necessary for secure delivery (Art. 6(1)(b) and (f) GDPR). For deliveries outside the EU, the customs authorities receive the information required for clearance (Art. 6(1)(c) GDPR).

9. Customer account
A customer account is optional. You log in via Shopify customer accounts with a one-time code sent to your email address. We store the account data until you request its deletion, unless retention obligations apply. Legal basis: Art. 6(1)(b) GDPR.

10. Contact by email, phone, WhatsApp and enquiry form
When you contact us, we process the information you provide in order to handle your enquiry (Art. 6(1)(b) GDPR where it relates to a contract, otherwise point (f)). We operate enquiry forms on our pages, for example for bespoke commissions, using Shopify Forms; Shopify processes the entries on our behalf. For WhatsApp, we use WhatsApp Business from WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In doing so, WhatsApp receives your telephone number and metadata; message contents are end-to-end encrypted. A transfer to Meta Platforms Inc. in the USA is possible and is based on the EU-US Data Privacy Framework. Use is voluntary; you can also reach us at any time by email or phone.

11. Newsletter
You only receive the newsletter with your consent (Art. 6(1)(a) GDPR), using the double opt-in procedure: after signing up, you confirm your email address via a link. We log the sign-up and confirmation as proof. For sending and managing the newsletter, we use Klaviyo by Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA, and Mailchimp by The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, USA, each as a processor. Both providers are certified under the EU-US Data Privacy Framework. We evaluate whether newsletters are opened and links are clicked. You can unsubscribe at any time via the link in every email or by sending a message to info@bevain.de.

12. Analytics and advertising (only with consent)
The following services only run once you have agreed in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent there at any time.

Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: measurement of reach and user behaviour, such as pages viewed, time spent, device and approximate location. Full IP addresses are not stored.

Google Ads conversion tracking and remarketing by Google Ireland Limited: measuring whether an ad led to a purchase, and serving ads to visitors to our shop.

Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland: measuring the effectiveness of ads on Facebook and Instagram, and building target audiences. We are joint controllers with Meta for the collection of the data and its transmission to Meta (Art. 26 GDPR); Meta alone is responsible for the further processing.

Klaviyo onsite tracking by Klaviyo, Inc.: recording which products you view and add to your basket in order to send newsletter subscribers relevant emails, for example about an abandoned purchase.

Google, Meta and Klaviyo may transfer data to recipients in the USA. Google LLC, Meta Platforms Inc. and Klaviyo, Inc. are certified under the EU-US Data Privacy Framework.

13. Instagram
We only link to our Instagram profile. Data only flows once you click the link; Meta's privacy policy then applies.

14. Online withdrawal
If you withdraw from a contract using our withdrawal function, we process your name, email address, order number and your statement in order to process the withdrawal and confirm its receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). The withdrawal function is provided by 401layers UG (haftungsbeschränkt), Germany, as a processor.

15. Storage period
We delete personal data as soon as the purpose of the processing no longer applies and no statutory retention obligations prevent deletion.

16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). You can lodge a complaint with a supervisory authority; the authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach.

Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing purposes at any time without giving reasons.

17. Obligation to provide data
For an order, we need the information marked as mandatory fields in the checkout. Without it, we cannot conclude the contract.

Last updated: 29 September 2026