Privacy Policy

Privacy Policy 

1. Information about the collection of personal data and controller details

1.1

We appreciate your visit to our website and your interest in our services. This Privacy Policy explains how we handle your personal data when you use our website. “Personal data” means any information that can identify you directly or indirectly.

1.2

The data controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is Sienna Coast The controller is the individual or entity that determines the purposes and means of processing personal data.

1.3

To protect your information and ensure secure transmission of confidential content (such as orders or inquiries), our website uses SSL/TLS encryption. You can recognize a secure connection by “https://” in the browser address bar and the padlock icon.

2. Data collection when visiting our website

If you visit our website for information only (i.e., without registering or submitting information), we only collect the data that your browser transmits to our server (so-called server log files). This includes data that is technically required to display the website correctly:

  • Pages visited on our website

  • Date and time of access

  • Amount of data transmitted (in bytes)

  • Referrer URL / source from which you accessed the page

  • Browser type and version

  • Operating system

  • IP address (where applicable, in anonymized form)

This processing is carried out under Art. 6(1)(f) GDPR based on our legitimate interest in maintaining and improving the stability, security, and functionality of our website. We do not use this data for other purposes, unless there are specific indications of unlawful use, in which case we may review log files retrospectively.

3. Cookies

To improve user experience and enable certain website features, we use cookies on some pages. Cookies are small text files stored on your device.

Some cookies are deleted when you close your browser (session cookies). Others remain stored and allow us (or our partners) to recognize your browser on future visits (persistent cookies). Persistent cookies are automatically deleted after a defined period, which may vary depending on the cookie.

Cookies may store and process certain information such as browser details, approximate location data, and IP address values.

In some situations, cookies help simplify the ordering process, for example by saving shopping cart contents for a later visit. Where personal data is processed through cookies, processing is based on:

  • Art. 6(1)(b) GDPR (if required for contract performance), or

  • Art. 6(1)(f) GDPR (legitimate interest in a functional, user-friendly website)

We may also work with advertising partners who place third-party cookies to help make our services more relevant and appealing. When this applies, we provide separate information about the use and scope of these cookies in the relevant sections below.

You can configure your browser to notify you when cookies are set, to accept cookies case-by-case, or to block cookies entirely. Please note that disabling cookies may limit certain website functions.

Browser help pages:

4. Contact

When you contact us (e.g., via email or contact form), we process personal data in order to respond to your request. The specific data collected via a contact form is shown in the form itself. We use this data solely to handle your inquiry and any related administration.

Legal basis:

  • Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries)

  • If your request is related to a contract: Art. 6(1)(b) GDPR

Your data will be deleted once your request has been fully handled, unless legal retention requirements apply.

5. Customer accounts and contract processing

Under Art. 6(1)(b) GDPR, we process personal data necessary to create a customer account and/or fulfill your order. The data collected is visible in the relevant input forms.

You may delete your customer account at any time by contacting the controller at the address listed above. After contract completion or account deletion, your data is restricted according to statutory commercial and tax retention periods and deleted once those periods end—unless you have given consent for continued processing or we are legally permitted to process the data further.

6. Use of data for direct advertising

6.1 Newsletter subscription

If you subscribe to our newsletter, we will send you updates and offers by email. The only required information is your email address. Any other details are optional and help us personalize communication.

We use the double opt-in method: you will only receive newsletters after confirming your subscription via a confirmation email link.

Legal basis: Art. 6(1)(a) GDPR (consent).
For security and proof, we store your IP address and subscription date/time recorded by your Internet service provider.

You can unsubscribe anytime using the link in each newsletter or by contacting us. After unsubscribing, your email address is removed immediately unless you have explicitly agreed to further use or we are legally entitled to retain it.

6.2 Newsletter for existing customers

If you provided your email address during a purchase, we may send you offers for similar products by email based on Art. 6(1)(f) GDPR (legitimate interest in direct marketing). You can object to this at any time with future effect by contacting us. Once we receive your objection, we will stop using your email for this purpose immediately.

7. Data processing for order handling

7.1 Shipping and payment processing

For delivery, we share your personal data with the shipping provider where required to fulfill the contract. For payment, we share payment details with the relevant payment service providers or financial institutions as necessary.

Legal basis: Art. 6(1)(b) GDPR.

7.2 Payment service providers

PayPal
If you choose PayPal (including credit card via PayPal, direct debit via PayPal, or installments where offered), payment processing is carried out via PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Data is transferred only as necessary under Art. 6(1)(b) GDPR.

PayPal may conduct credit checks for certain payment methods under Art. 6(1)(f) GDPR. More details can be found in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

SOFORT
If you choose “SOFORT,” payment is processed by SOFORT GmbH (Germany), part of the Klarna Group. Your order/payment information is shared only to the extent required under Art. 6(1)(b) GDPR.
More details: https://www.klarna.com/sofort/datenschutz

8. Review reminders

If you explicitly consent, we may use your email address to send you a one-time reminder to leave a review regarding your order (not via an external review system).

Legal basis: Art. 6(1)(a) GDPR.
You may withdraw your consent at any time by contacting us.

9. Social media plugins

9.1 Facebook (Shariff solution)

Our website uses social media buttons for Facebook. To protect your privacy, these buttons are implemented as HTML links (Shariff solution) and do not automatically connect to Facebook servers when a page loads. A connection is only established if you actively click the button.

For details, please see Facebook’s privacy policy: https://www.facebook.com/policy.php

9.2 Google+ (Shariff solution)

Our website may use social media buttons for Google+. These are also implemented as HTML links to improve privacy, meaning no automatic server connection occurs until you click the button.

Google privacy policy: https://www.google.com/intl/de/policies/privacy/

9.3 Instagram (Shariff solution)

Instagram buttons may be used in the same privacy-friendly way (HTML links). A connection to Instagram servers is only made if you click the button.

Instagram privacy policy: https://help.instagram.com/155833707900388/

10. Online marketing

10.1 DoubleClick by Google

We use DoubleClick by Google (Google LLC, USA) to deliver relevant ads, measure campaign performance, and prevent duplicate ad displays. DoubleClick uses cookies and cookie IDs and may also measure conversions.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in effective marketing).

You can disable conversion cookies via browser settings (e.g., blocking cookies from googleadservices domains) or adjust ad settings through industry opt-out pages such as aboutads.info.
Google privacy policy: https://www.google.de/policies/privacy/

10.2 Google Ads conversion tracking

We use Google Ads conversion tracking to measure advertising effectiveness. A cookie is set when you click a Google ad and may remain valid for up to 30 days. It is used to generate conversion statistics and does not directly identify you personally.

Legal basis: Art. 6(1)(f) GDPR.

You can disable this via your browser settings or via Google’s ad settings tools, where available.

11. Web analytics services

Google (Universal) Analytics
We use Google Analytics to analyze website usage and improve performance and marketing. Google Analytics uses cookies. Data such as your IP address may be processed in anonymized form using the “_anonymizeIp()” feature.

Legal basis: Art. 6(1)(f) GDPR.

You can prevent cookies via browser settings, install Google’s opt-out plugin, or use an opt-out mechanism where provided.

12. Retargeting / remarketing / recommendation advertising

Facebook Custom Audience (Pixel)

With your explicit consent, we may use the Facebook Pixel to measure ad effectiveness and improve campaigns. Data is processed by Facebook and may be linked to your Facebook profile.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can restrict cookie storage in your browser or use industry opt-out solutions such as aboutads.info.

Google Ads Remarketing

We use Google remarketing to display interest-based ads based on visited pages and a pseudonymous cookie ID.

Legal basis: Art. 6(1)(f) GDPR.

You can disable ad personalization via Google settings or install the relevant browser plugin where available.

13. Rights of the data subject

You have the following rights under GDPR regarding your personal data:

  • Right of access (Art. 15)

  • Right to rectification (Art. 16)

  • Right to erasure (Art. 17)

  • Right to restriction of processing (Art. 18)

  • Right to be informed (Art. 19)

  • Right to data portability (Art. 20)

  • Right to withdraw consent (Art. 7(3))

  • Right to lodge a complaint with a supervisory authority (Art. 77)

13.2 Right to object

If we process your personal data on the basis of legitimate interests, you may object at any time for reasons arising from your particular situation. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds.

If your data is processed for direct marketing, you may object at any time, and we will stop using your data for that purpose.

14. Storage duration

We retain personal data only as long as necessary and in accordance with statutory retention obligations (e.g., tax and commercial requirements). After the relevant retention periods end, data is routinely deleted unless it is still required for contract performance or there is another lawful basis for retention.