Politique de confidentialité

Privacy policy

Last updated: 16 September 2026

1. Who is responsible

The controller for the personal data processed in this shop (lulabini.de and lulabini.com, brand "LulaBini") is:

MAG Retail LLC
501 Silverside Road, Suite 105
Wilmington, DE 19809, USA
Email: info@lulabini.com

Please send any privacy question, access request or objection to that address. It is handled there.

We have not appointed a data protection officer, because we are not required to.

2. Where your data is processed

We are a company based in the USA. When you order from us, you give your data directly to a company outside the EU. We process it ourselves and with the service providers listed below, some of which are based in the USA or in China. For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework) where the recipient is certified under it. For all other recipients outside the EU, in particular our logistics partner in China, we use the European Commission's standard contractual clauses. You can request a copy using the contact details above.

3. When you visit our website

Hosting and shop system. Our shop runs on the platform of Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada. On our behalf, Shopify processes the technical data of your visit (for example IP address, device, browser, pages viewed, time) so that the website works and stays secure. The legal basis is our legitimate interest in a secure, working shop (Art. 6(1)(f) GDPR).

Necessary cookies. We set cookies for the cart, checkout, language setting and security, without which the shop does not work. These need no consent (section 25(2)(2) TDDDG). To protect against misuse, for example automated sign-ups, we also use hCaptcha, a service of Intuition Machines, Inc., USA. The legal basis is Art. 6(1)(f) GDPR.

All other cookies and tracking only with your consent. We load the analytics and marketing services in section 7 only once you have agreed in the cookie banner (Art. 6(1)(a) GDPR, section 25(1) TDDDG). You can change or withdraw your consent at any time in the cookie settings in our shop.

4. When you order

For your order we process your name, delivery and billing address, email address, phone number where given, the items ordered and payment and shipping information. The legal basis is performance of the contract with you (Art. 6(1)(b) GDPR). Without this data we cannot enter into the contract.

Payment. Depending on the method you choose, we pass your payment data to Shopify Payments (credit card, Apple Pay, Google Pay, Shop Pay), to PayPal (Europe) S.a r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, or to Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg. PayPal and Amazon Pay also process your data as controllers in their own right, for example to prevent fraud. Their privacy notices apply in addition.

Fraud prevention. To prevent payment fraud, Shopify checks orders automatically for anomalies, for example the IP address or address mismatches. The result is a recommendation to us; a person decides about an order. The legal basis is our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Shipping. So that your order reaches you, we pass your name, delivery address, phone number where given and the items ordered to our fulfilment provider in China, who packs and ships the goods, and to the carriers used (among them YunExpress and the delivery company in your country, for example DHL, Austrian Post or Swiss Post). Carriers get your email address only where they are to notify you about delivery. The legal basis is Art. 6(1)(b) GDPR.

Returns. Returns are received on our behalf by LulaBini Retouren, Gaertnerstrasse 62B, 80992 Munich, Germany. They learn your name and what you sent back.

Customer account. If you use a customer account, we store your addresses and orders there until you delete the account. The legal basis is Art. 6(1)(b) GDPR.

5. When you contact us

Email and contact form. When you write to us, we process your message and your contact details in order to deal with your request. Our mailbox is run at Google (Gmail); to handle requests we use our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

The legal basis is Art. 6(1)(b) GDPR where your request concerns an order, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

6. Emails from us

Newsletter. You only receive our newsletter if you signed up and confirmed it through the link in our confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). We send the newsletter with Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, and measure whether an email was opened and which links were clicked, in order to improve it. You can unsubscribe at any time using the link at the end of every email.

Cart reminder. We only send you a reminder about an unfinished purchase if you agreed to email marketing during checkout (Art. 6(1)(a) GDPR).

Product recommendations to customers. If you have bought from us, we may send recommendations for similar products of our own to the email address you gave, unless you have objected (section 7(3) UWG, Art. 6(1)(f) GDPR). You can object at any time, through the link in every email or informally to info@lulabini.com, at no cost beyond the basic transmission rates.

Review requests. We only ask you for a review by email with your consent (Art. 6(1)(a) GDPR). For reviews we use Judge.me. If you leave a review, we publish it with your first name and the first letter of your surname.

7. Analytics and marketing (only with consent)

We use the following services only once you have agreed in the cookie banner (Art. 6(1)(a) GDPR, section 25(1) TDDDG). They store or read information on your device and can recognise you across websites.

  • Meta pixel and Conversions API (Facebook, Instagram): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use it to measure whether our ads lead to purchases and to show you relevant ads. For collecting and transmitting the data we are joint controllers with Meta (Art. 26 GDPR); the arrangement is at https://www.facebook.com/legal/controller_addendum. Meta may also transfer data to the USA.
  • TikTok pixel: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. Same purpose as the Meta pixel.
  • Snapchat pixel: Snap B.V., Amsterdam, Netherlands. Same purpose as the Meta pixel.
  • Pinterest tag: Pinterest Europe Limited, Dublin, Ireland. Same purpose as the Meta pixel.
  • Google Ads, Google Analytics and Google Merchant Center: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use these to measure advertising results and how the shop is used.
  • Trackify X: an app of our provider Trackify. It sends purchase events to the advertising platforms above.
  • Microsoft Clarity: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity records anonymously how visitors use the page (mouse movement, clicks, scrolling) so that we can improve it. Entries in form fields are masked.
  • OptiMonk: OptiMonk International Zrt., Hungary. We use it to show notices and sign-up windows, for example for the newsletter.
  • Elevate A/B testing: an app of our provider Elevate. We use it to test different versions of our pages.
  • Klaviyo (onsite tracking): Klaviyo, Inc., USA. It recognises which products you looked at, so that we can send you relevant emails if you subscribe to the newsletter.

8. How long we keep your data

We delete your data as soon as we no longer need it for the purpose in question. We keep order and invoice data for as long as commercial and tax law require, as a rule up to ten years. Customer service enquiries are deleted at the latest two years after they are closed. Newsletter data is deleted when you unsubscribe; we keep a record of the unsubscribe itself so that we do not write to you again by mistake. Cookies are deleted at the end of your visit or after the lifetime stated in the cookie settings, depending on the service.

9. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)). Just write to info@lulabini.com.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons; we then stop using it for that purpose.

Right to complain: you can complain to any data protection supervisory authority, in particular in the country where you live. As we have no establishment in the EU, there is no lead authority for us.

10. Changes

If our shop or the services we use change, we update this privacy policy. The version published here is the one that applies.