Privacy

Privacy Policy

1. Scope

This privacy policy applies to the website laduti.de (including all sub-pages) and the online services offered through it (shop, customer account, contact).

2. Principles of data processing

We process personal data only to the extent permitted by law. Legal bases under Art. 6(1) GDPR:

  • b – performance of a contract and pre-contractual measures (e.g. orders, customer account, support)
  • c – legal obligation (e.g. retention obligations)
  • f – legitimate interests (e.g. secure, economical and user-friendly provision of the website, prevention of misuse and fraud)
  • a – consent (e.g. statistics/marketing cookies, Google Ads measurement)

3. Categories of data processed

  • Master data (name, address), contact data (email, telephone number)
  • Contract and order data (products, prices, payment and delivery information, invoice data)
  • Account and login data (if a customer account is created)
  • Usage, log and device data (IP address, time of access, user agent, referrer, cookies/consent status)
  • Country-level geodata for determining prices and delivery (see section 11)

4. Hosting, security & content delivery

We use professional hosting and security services to provide the website securely and efficiently. In doing so, IP addresses, timestamps, content accessed and error logs, among other things, are processed in order to ensure the operation, availability and security of the website. The legal basis is Art. 6(1)(f) GDPR.

5. Server log files

Each time a page is accessed, server log files are stored automatically (IP address in truncated or full form, date/time, file/URL accessed, volume of data transferred, notification of successful retrieval, browser type and version, operating system). For security reasons (e.g. to investigate misuse or fraud), the log files are stored for a short time and then deleted. Legal basis: Art. 6(1)(f) GDPR.

We use cookies and similar technologies. Necessary cookies are indispensable for operation (Art. 6(1)(f) GDPR). For statistics/marketing technologies, we obtain your consent in advance (Art. 6(1)(a) GDPR).

You can change or withdraw your consent at any time with effect for the future (e.g. via the cookie settings in the footer or the configuration menu of your browser or device).

If you consent, we use Google Analytics 4 to measure reach. Usage data (e.g. page views, interactions) is processed; IP addresses are truncated. We use Google Consent Mode, which sends only aggregated, cookieless pings where consent has not been given. Legal basis: Art. 6(1)(a) GDPR.

Recipients: Google Ireland Limited (processing in the EU) and, where applicable, Google LLC (USA). Transfers to third countries are made on the basis of appropriate safeguards (e.g. standard contractual clauses). Retention period for event data in GA4: generally 2–14 months (depending on configuration).

8. Tag management (Google Tag Manager)

Google Tag Manager is used for the central management of scripts/tags. GTM itself does not process user data for its own purposes; downstream services are triggered only in accordance with your consent. Legal basis: Art. 6(1)(f) or (a) GDPR (depending on the tag).

9. Marketing/conversion measurement (Google Ads)

With your consent, we use Google Ads conversion measurement and – where applicable – remarketing. Interaction data is processed in order to measure the effectiveness of adverts and (if activated) to display advertising relevant to target groups. Legal basis: Art. 6(1)(a) GDPR.

Enhanced Conversions: if you give consent in the course of your purchase, hashed contact details (e.g. email, hashed with SHA-256) may be transmitted to Google in order to match orders with ad clicks. This improves measurement accuracy without passing on plain-text data. Legal basis: Art. 6(1)(a) GDPR.

10. Shop functions (WooCommerce) & country-based prices

We use WooCommerce to process orders. In doing so, we process the data you enter for the performance of the contract (Art. 6(1)(b) GDPR).

To display prices, taxes and delivery correctly, we use country detection based on the IP address and/or browser or checkout details (e.g. “Price Based on Country”). No precise movement profile is created; geolocation takes place at country level. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our offer correctly).

11. Customer account

You can create a customer account on a voluntary basis. The data required for this is processed to make ordering convenient and to manage your data. Legal basis: Art. 6(1)(b) GDPR. You can delete the account at any time; statutory retention obligations remain unaffected.

12. Payment processing (Stripe)

Depending on the method chosen, payments are processed via the payment service provider Stripe. For this purpose, payment data, name, billing address and, where applicable, email/telephone are transmitted to Stripe. Legal bases: Art. 6(1)(b) (contract), (f) (fraud prevention) and, where applicable, (c) (legal obligations) GDPR.

Recipients: Stripe Payments Europe, Ltd. (EU) and, where applicable, affiliated Stripe companies (including in the USA). Transfers outside the EEA are made on the basis of appropriate safeguards (e.g. standard contractual clauses).

13. Shipping, fulfilment & tracking

For the performance of the contract, we transmit the data required for shipping (name, address and, where applicable, email/telephone for delivery information) to transport and logistics companies (e.g. DHL, DPD, UPS). Legal basis: Art. 6(1)(b) GDPR.

A fulfilment/back-office service provider (e.g. Billbee GmbH) and a parcel tracking service (e.g. “Parcel Panel”) may be used for order processing/automation. Processing is carried out as commissioned processing in accordance with Art. 28 GDPR.

14. Product reviews & trust services (Trusted Shops)

A trustbadge/widget from Trusted Shops may be integrated into our site in order to display reviews/trust signals and, where applicable, to send invitations to submit reviews (after purchase). Pseudonymous data (e.g. order/email hash) may be used for verification. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in a trustworthy presentation and – for review invitations – where applicable Art. 6(1)(a)/(b) GDPR.

15. Languages & translation (TranslatePress)

We use a translation plugin to provide the website in several languages. It may store a functional cookie (e.g. language preference) in order to display the website in the language you have chosen. Legal basis: Art. 6(1)(f) GDPR.

16. Communication (email support)

If you contact us by email, the data you transmit is processed for the purpose of handling your enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR.

17. Data recipients, processors & transfers to third countries

We use carefully selected service providers (processors) for hosting, security, shipping, payment processing and shop, analytics and marketing functions. Contracts in accordance with Art. 28 GDPR are in place with all service providers.

Where data is processed outside the EEA (e.g. USA, UAE), this takes place only if an adequacy decision exists or appropriate safeguards are in place (e.g. EU standard contractual clauses) and additional protective measures are taken.

18. Retention period

  • Contract/order data: statutory commercial and tax retention periods (generally up to 10 years)
  • Customer account: until the account is deleted (unless longer statutory obligations apply)
  • Contact enquiries: until they have been conclusively dealt with, followed by regular review of the need for deletion
  • Analytics/marketing data: in accordance with the respective tool configuration and until you withdraw your consent
  • Server logs: short-term (security/error analysis), followed by deletion/anonymisation

19. Obligation to provide data

The provision of personal data is necessary for concluding a contract/placing an order. Without this data, an order cannot be placed or the contract processed. There is no obligation in respect of optional analytics/marketing; these take place only with consent.

20. Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(e) or (f) (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

To exercise your rights, an informal message to [email protected] is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.

21. Minors

Our offer is not aimed at children. If we become aware that personal data of minors is being processed without the required consent, we will delete this data without delay.

22. Data security

We take technical and organisational measures to protect personal data against loss, destruction, access, alteration or dissemination by unauthorised persons (e.g. TLS encryption, access restrictions, backups).

23. Withdrawal form and withdrawing from a contract

If you use our online withdrawal form, we process the personal data you provide (e.g. name, email address, order or contract number and, where applicable, further voluntary information) in order to receive and process your withdrawal and to meet statutory documentation obligations.

Processing takes place to fulfil our legal obligations and to carry out pre-contractual or contractual measures.

The data transmitted in the course of the withdrawal is stored only for as long as is necessary to process the withdrawal and to comply with statutory retention obligations.

After submitting your withdrawal, you will receive an automatic acknowledgement of receipt at the email address you provided. This serves solely to document and confirm receipt of your withdrawal.

24. Controller

Lazru Cosmetics Trading L.L.C
NGI Building, Office 902-25
Port Saeed, Dubai, UAE
PO Box 12887
Email: [email protected]
Register No. 1619334
VAT ID: DE351395187

25. Changes to this privacy policy

We will update this policy if the legal situation, services or processing operations change. The current version is available on this page.

Last updated: 19 June 2026