Privacy

This translation is provided for information only. Only the German version is legally binding. Read the German version

At a glance

Our online shop is aimed exclusively at business customers. We process personal data only to the extent we need it to run the shop, to review and approve your trade account and to handle your orders.

• No tracking on the website, no analytics or advertising services, no social media plug-ins. We do not send a newsletter.
• We serve fonts, images and scripts from our own server. Your browser does not connect to any other provider when you visit the shop.
• We use only technically necessary cookies: the session cookie for signing in and for forms, a cookie holding your choice of language (only if you switch the language) and a cookie holding your decision in the cookie notice. Further services only with your consent; there are none at present.
• The shop, the merchandise management system and the databases run on a single server in a data centre in Germany, which we operate ourselves.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Oliver Schmid Silberschmuckhandel Sophienstr. 6 60487 Frankfurt Germany

Represented by: Oliver Schmid Phone: 069 / 60 60 70 24 E-mail: service@mystic-maya.de

You will find the full provider details in our imprint. For any questions about data protection and for exercising your rights, you can reach us using the contact details given there.

2. Hosting and server logs

Our shop (shop system Medusa), our merchandise management system (ERPNext), the databases and the storage for product images run on a single server that we operate ourselves. We rent the server from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; it is located in a data centre in Germany. IONOS provides the server and the data centre and has access to the stored data only within the scope of this service. We have concluded a contract with IONOS for this purpose (data processing agreement under Art. 28 GDPR).

Each time a page is requested, our server automatically logs:

• the IP address of the requesting device,
• the date and time of the request,
• the address requested, the method of transfer and the status code of the response,
• the amount of data transferred and the processing time,
• the page visited before (referrer), if your browser sends it,
• the identifier of your browser (user agent).

We need this information to run the shop securely and reliably, to find errors and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security and functioning of our systems. We do not combine the logs with other data. The logs are limited by size, not by time: for each service we keep at most three files of 10 MB each; once this limit is reached, the oldest file is deleted. How long an entry is kept therefore depends on the volume of traffic.

To protect against misuse, we limit how often sign-ins, registrations, password reset requests and changes to the trade account can be triggered within a short time. For this we hold an irreversible short value (hash) of the IP address, the e-mail address or the customer identifier in memory for at most one hour; it is not stored permanently.

3. Cookies and local storage

The following table lists everything this website stores in your browser. We do not write to your browser's permanent storage (localStorage); the website merely removes the entry “mm_recent” there, which an earlier version created.

On your first visit, a notice at the bottom of the screen asks for your decision (“Accept all”, “Necessary only” or “Settings”). We currently use only strictly necessary cookies and entries; under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) they require no consent. We base the associated processing on Art. 6(1)(b) GDPR (use of your trade account) and Art. 6(1)(f) GDPR (protection of our forms, display in the language you have chosen). We use other services, such as statistics, marketing or content from other providers, only if you allow them in the notice or in the cookie settings (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); there are none at present. We do not use tracking pixels or similar techniques, and the website loads no content from other providers.

You can change or withdraw your decision at any time via “Cookie settings” at the bottom of every page; a withdrawal takes effect for the future. If the website asks again after a change to this list, your earlier decision no longer applies.

Record of your decision: so that we can prove that a decision was made (Art. 7(1) GDPR), we store an anonymous entry for each decision on our own server: a random identifier (the same as in the cookie “mm_consent”), the time, the version of the cookie list, the categories chosen and the language of the page – no IP address, no account, no browser details. The legal basis is Art. 6(1)(c) GDPR. We delete the entries after three years. For the e-mails we send you, see section 10.

4. Registration as a business customer

When you apply for a trade account, we process the details from the registration form:

• company name, username and line of business,
• VAT identification number and/or tax number (at least one of the two) and, optionally, the commercial register number,
• first and last name of the contact person, phone number (optional) and e-mail address,
• billing address,
• your password, which we store only as an irreversible hash,
• the language of the page on which you register (German or English), as the language of our e-mails to you; until e-mails in English are available, we write to you in German,
• proof of your business activity (for example a trade registration or an extract from the commercial register) that you upload when you register or submit later, or your statement that you will submit it later,
• your confirmation that you act as a business within the meaning of § 14 BGB (German Civil Code), together with the time and the version of the terms and conditions.

We use these details to set up your trade account, to verify your status as a business and to conduct the subsequent business relationship. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and contract). Where we process data of contact persons of a company, we rely on Art. 6(1)(f) GDPR; our legitimate interest lies in initiating and conducting the business relationship with the company. Consent is not required for this, so we do not ask for it.

The data is stored in our merchandise management system (ERPNext) and in the shop system (Medusa), both of which run on our own server. We may inform the staff responsible about new registrations internally by e-mail.

5. Verification of the VAT ID

If you give a VAT identification number when registering or when you later change your company details, we check its validity through the VAT Information Exchange System (VIES) of the European Commission, Rue de la Loi 200, 1049 Brussels, Belgium. Only the country code and the number are transmitted; we do not send your name, address or e-mail address. We store the result of the check with your trade account.

The check serves to establish your status as a business and the correct VAT treatment of your orders (for example for intra-Community supplies). The legal bases are Art. 6(1)(c) GDPR in conjunction with the record-keeping obligations of the German VAT Act and Art. 6(1)(f) GDPR; our legitimate interest lies in selling only to businesses. The European Commission is a body of the European Union; no transfer to a third country takes place.

6. Approval and proof of trade

Every new trade account is reviewed by a member of staff and approved or rejected. It is approved only once we have your proof of trade and have checked it; only then can you see the collection and prices. You upload the proof (for example a trade registration or an extract from the commercial register; PDF, JPG or PNG, at most 10 MB per file) when you register or later in your trade account; we keep up to three files, and a further one replaces the oldest. If we receive it by e-mail or post, our staff file it for you. We use it to verify your status as a business. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and, where we are legally obliged to verify, Art. 6(1)(c) GDPR. The files are kept protected in our merchandise management system on our own server, are accessible to our staff only and cannot be retrieved via a public address. We keep them for as long as the business relationship exists and thereafter for the statutory retention periods.

If you later request a change to your company details (company name, VAT identification number or commercial register number), we store the request with the time and the result of the check until a member of staff has applied or discarded it. The request data is then deleted; if the change is applied, the new details replace the previous ones.

7. Trade account, sign-in and security

To sign in, we use your e-mail address and your password. You can change contact details and addresses yourself in your trade account. For the following actions you automatically receive a message from us by e-mail:

• Forgotten password: a link to set a new password; it is valid for 15 minutes and can be used only once.
• Change of e-mail address: a confirmation link to the new address (valid for one hour) and a notice to the previous address.
• Change of password: a confirmation.
• Request to change company details: an acknowledgement of receipt.
• Approval or rejection of your trade account: a notification.

After a change of password or e-mail address, we end all other signed-in sessions. The links in these e-mails carry their security code in a part of the address that your browser does not send to servers. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (protecting your account against unauthorised access).

8. Orders, delivery and invoices

For orders we process your customer and contact details, billing and delivery address, the items ordered and their prices and, later, the delivery note, invoice and receipt of payment. You pay by bank transfer (in advance or on invoice); no payment service provider is involved. We issue invoices as electronic invoices (PDF with embedded invoice data) and archive them so that they cannot be altered. You can view your orders and invoices in your trade account.

For delivery we pass your name, company, delivery address and, where applicable, phone number to the carrier we use to send your shipment (parcel service or freight forwarder). You can see which company that is in your order overview as soon as the shipment is on its way. The carrier processes this data for delivery under its own responsibility. If your order overview contains a tracking link, clicking it takes you to the carrier's website, where its privacy policy applies. Where we engage a tax adviser, they receive the invoice and accounting data required for bookkeeping and tax returns.

The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (obligations under commercial and tax law).

9. Saved pieces, recently viewed products and views

Items you save are stored in your trade account until you remove them or your account is deleted.

“Recently viewed”: when you open a product page as a signed-in customer, we store the identifier of that product on the server in your trade account. The list holds at most the 12 most recently viewed products, is visible only to you in the catalogue and serves solely to make it easier for you to find items in the shop again. Older entries drop out automatically as you view newer products. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in making the shop convenient to use.

We also count views per product and day without any reference to you: only the item, the date and the number are stored. These figures help us plan the collection and are deleted automatically after two years.

10. Contact and sending of e-mails

If you contact us by e-mail or phone, we process your details to deal with your enquiry (Art. 6(1)(b) GDPR for questions about a contract or order, otherwise Art. 6(1)(f) GDPR).

E-mails sent to our addresses are currently received and stored on our behalf by Telekom Deutschland GmbH, Landgrabenweg 149, 53227 Bonn, Germany. All automatic e-mails from the shop and the merchandise management system (see sections 6 to 8), for example registration and account messages, order confirmations, shipping notices, invoices and payment reminders, are sent through the delivery service (Transactional Email, SMTP relay) of Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France. If this service fails, we send them instead through the delivery service (SMTP relay) of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (part of the Brevo group; parent company Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France). For this, the delivery service used receives the recipient address, sender, subject and content of the e-mail including attachments, as well as technical delivery data (for example time and delivery status). Scaleway processes this data in its Paris region in France; according to Brevo, the data is stored exclusively in data centres in the European Union (France, Germany and Belgium). All three providers process the data on our behalf (Art. 28 GDPR) on the basis of a data processing agreement.

Open and click tracking by Brevo (only when sending through Brevo as a fallback): we do not add tracking pixels or redirected links to our e-mails ourselves. When sending, however, Brevo may insert an invisible tracking pixel and redirect links in the e-mail through its own addresses. Brevo can then record whether and when an e-mail was opened and whether a link in it was clicked; in doing so, the IP address and the identifier of your browser or e-mail program are transmitted to Brevo. We use this information only to trace the delivery of our e-mails, not for advertising and not for profiles. The legal basis is Art. 6(1)(b) GDPR (contract-related messages) and Art. 6(1)(f) GDPR (proof of delivery). You can prevent the tracking pixel by switching off the automatic loading of images in your e-mail program. We do not send a newsletter or other advertising e-mails; we write to you only in connection with your trade account and your orders.

Outgoing e-mails wait in a queue in our merchandise management system until they are sent; we delete its entries after 30 days. For e-mails with security links, we remove the content and the link immediately after sending.

11. Trade fairs

On the “Trade fairs” page we give only the name, date and place of the fairs at which we exhibit. The page has no form and no registration; we process no personal data there beyond the server logs (section 2).

12. Disclosure to other parties

• IONOS SE (hosting: server and data centre in Germany, processor, see section 2)
• Scaleway SAS (sending automatic e-mails from the shop and the merchandise management system, processor, see section 10)
• Brevo GmbH (sending automatic e-mails as a fallback, processor, see section 10)
• Telekom Deutschland GmbH (receiving and storing e-mails sent to our addresses, processor, see section 10)
• European Commission (verification of the VAT identification number, country code and number only)
• the carrier we use to send your shipment (delivery, see section 8)
• our tax adviser, where we engage one (bookkeeping and taxes)
• authorities, where we are legally obliged to do so (for example the tax office)

We do not sell data and do not pass it on to third parties for advertising purposes.

13. Third countries

Our shop systems run on the server in Germany named in section 2; we ourselves do not transfer your data to countries outside the European Union or the European Economic Area. Our delivery service Scaleway processes the data in France. According to its own information, our fallback delivery service Brevo stores the data exclusively in the EU; where Brevo uses parties outside the EU or the EEA for individual services, EU standard contractual clauses in the data processing agreement safeguard this. Our mailboxes are hosted by Telekom Deutschland GmbH in Germany. Where one of these providers uses parties outside the EU or the EEA for individual services, this is permitted only on the basis of an adequacy decision of the EU Commission or of EU standard contractual clauses (Art. 44 et seq. GDPR).

14. Storage period

We store personal data only for as long as it is required for the respective purpose. For your trade account this means: for the duration of the business relationship. After that we delete the data unless statutory retention obligations prevent this. Under § 147 of the German Fiscal Code (Abgabenordnung) and § 257 of the German Commercial Code (Handelsgesetzbuch), such obligations apply above all to invoices and other accounting records (eight years), to commercial and business letters (six years) and to books and annual financial statements (ten years). While these periods run, we restrict processing to storage.

Shorter periods: server logs per service up to a size of three files of 10 MB each (section 2), the session cookie 24 hours and the language cookie one year (section 3), the e-mail queue 30 days (section 10), the anonymous view count two years (section 9). We keep our encrypted backups on the same server for 7 days (merchandise management system) and 14 days (shop system) respectively; deleted data disappears from the backups at the latest when these periods expire.

15. Your rights

You have the right vis-à-vis us

• to information about the data we process (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR),
• to data portability (Art. 20 GDPR),
• to withdraw consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to the contact details given in section 1 and in the imprint is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information) Wilhelmstraße 7 65185 Wiesbaden, Germany Phone +49 611 1408-0 E-mail poststelle@datenschutz.hessen.de Website datenschutz.hessen.de

16. Obligation to provide data

We need the details marked as required fields in the registration and ordering process to conclude and perform the contract. Without them we cannot set up a trade account or accept orders. You may leave out optional details, such as your phone number.

17. No automated decision-making

We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. A member of staff always decides on the approval and rejection of a trade account.

18. Data security

All connections to our shop are TLS-encrypted. We store passwords only as a hash and backups only in encrypted form, and uploaded documents cannot be retrieved publicly. Only staff who need access to customer data for their tasks have it.

19. Version

Version: October 2026. If our data processing changes, we adapt this privacy policy. The version published here at any given time applies.

You will find the full provider details in the imprint.