Privacy policy

Who is responsible

The controller of your data is Karam Schama, Dunjali (sole proprietorship), Weißrosenstraße 12, 78532 Tuttlingen, Germany. Email: jads9755@gmail.com.

At our current size we are not required to appoint a data protection officer; write to the email above with any question.

What we collect

Account: name, email, phone and a hashed password we cannot read.

Orders: delivery address, items, amounts, delivery status and tracking number.

Card payments are handled by the payment provider; we never store your card number.

The delivery country you choose, to show the right currency, shipping and tax.

When you report a listing: your name, email and what you wrote.

When you withdraw from a purchase: your name, email, the order, what you withdraw from and when we received it. We keep this for up to 3 years after handling it, to prove receipt (limitation period).

For sellers: business details, the seller passport, an ID document, bank account, and the tax details DAC7 requires (including tax ID and, for individuals, date of birth).

Technical data: IP address and request time in server logs, to protect the store against attacks.

Reviews: your rating and text, published with the name you choose (or «Verified buyer»). They stay published until you delete them or we hide them.

Price alerts: your email, the product and any target price. We send nothing until you confirm the alert from a link in an email (double opt-in), and you stop it in one click; we delete it when stopped.

Help messages: your name, email, order number and what you wrote, to answer you.

Gifts: the recipient's name and address and your message, used only to deliver the gift. If you received a gift, this policy covers you too: the sender gave us your details.

Business accounts and quote requests: company name, VAT ID and what you ask for; we pass the request to the seller concerned.

For sellers also: which version of the seller terms they accepted and when, and the reasons for any suspension or restriction.

Error reports: when something fails on our servers, we send the technical error and the page to our error-reporting provider (Sentry), without form or payment data.

Why, and on what legal basis

Fulfilling and delivering your order, handling returns and refunds, and running seller accounts: to perform the contract (Art. 6(1)(b) GDPR).

Keeping invoices, collecting and reporting sellers' tax details (PStTG), and handling notices under the Digital Services Act: legal obligation (Art. 6(1)(c) GDPR).

Protecting the store against fraud and repeated sign-in attempts: our legitimate interest (Art. 6(1)(f) GDPR).

Analytics and advertising cookies: only with your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can withdraw any time.

Price alerts: your consent (Art. 6(1)(a) GDPR), withdrawn by stopping the alert. Publishing reviews, help messages, quote requests and gifts: to do what you asked (Art. 6(1)(b)); the gift recipient's details: our legitimate interest in delivering it (Art. 6(1)(f)). Error reports: our legitimate interest in a working store (Art. 6(1)(f)).

We don't use your data for outside advertising without your consent. Decisions that significantly affect you, such as closing an account, are made by a person, not a machine.

Who we share it with

The seller: only what they need to prepare their part of the order. The courier: name, address and phone, to deliver. The payment provider Stripe (Stripe Payments Europe, Ireland): what's needed to take payment, check it for fraud and refund it.

Hosting, email and IT service providers, who process data only on our instructions under a processing agreement: among them Resend (USA) for sending emails, Sentry (USA) for error reports and Anthropic (USA) for Ask Dunjali.

The Federal Central Tax Office (BZSt) for sellers' tax details, and authorities where the law requires it. A seller never learns who reported their listing.

Outside the EU

Some items ship from outside the EU (for example the Gulf or China). The seller or supplier who ships them receives only what shipping needs (name, delivery address, phone and the items), because that is necessary to perform the contract you asked for (Art. 49(1)(b) GDPR). Products we sell ourselves from our supplier CJdropshipping ship from China or from its warehouses in other countries, so we send it these details for each such order. China has no EU adequacy decision, so data protection there may be lower than in the EU.

With service providers outside the EU we work only under appropriate safeguards: an adequacy decision (such as the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses. This includes the advertising partners (Google, Meta, TikTok, Snapchat) if you allow advertising cookies.

Ask Dunjali

Ask Dunjali is an AI assistant (Claude by Anthropic), not a person; its answers are generated automatically. If you use it, we send your question and product information to Anthropic (USA) to write the answer, without your name or account details. Please don't type personal data into it.

How long we keep it

Account: until you ask us to delete it. Orders and invoices: as long as German tax and commercial law requires (up to 10 years). Sellers' tax details: 10 years under the PStTG. Notices: as long as needed to handle them and any appeal. Price alerts: until you stop them. Help messages: as long as needed to answer them and for any claim that follows. Sellers' ID documents: as long as the seller account exists, then only as long as the law requires. Error reports: as long as our provider keeps them for us. Server logs: normally no more than 30 days.

Cookies

Only essential cookies run by default: your sign-in session, delivery country, language and your cookie choice. Your bag and wishlist stay on your device.

Analytics and advertising cookies (Google, Meta, TikTok, Snapchat) run only if you allow them, and you can change your mind any time from “Cookie settings” at the bottom of every page. Details are in the cookie policy.

Your rights

You have the right to access, correct, delete, restrict and port your data, and to withdraw consent at any time. Write to us at the email above. Account and order data are needed to make and perform the contract: without them we can't deliver your order. Sellers' tax details are required by law.

Right to object: where we process your data for our legitimate interests, you can object at any time on grounds relating to your particular situation.

You can complain to any data protection authority, including ours: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

If you live in Saudi Arabia, the Personal Data Protection Law (PDPL) applies to you, with the rights to be informed, to access, correct and destroy your data and to withdraw consent. Your data is transferred to Germany (where we operate) and to the seller you buy from, to perform your order. You can complain to the Saudi Data and AI Authority (SDAIA). If you live in Qatar, the Personal Data Privacy Protection Law (Law No. 13 of 2016) applies to you, and you can complain to the National Cyber Security Agency. In the other Gulf states their own laws apply, where they exist, and your rights there may differ.

Contact us

Dunjali · jads9755@gmail.com