Privacy policy

1. scope of application

This privacy policy applies to the website laduti.de (including all subpages) and the online services offered via it (store, customer account, contact).

2. Principles of data processing

We only process personal data to the extent permitted by law. Legal basis according to Art. 6 para. 1 GDPR:

  • b - Contract fulfillment and pre-contractual measures (e.g. orders, customer account, support)
  • c - legal obligation (e.g. retention obligations)
  • f - legitimate interests (e.g. secure, economical and user-friendly provision of the website, prevention of abuse/fraud)
  • a - Consent (e.g. statistics/marketing cookies, Google Ads measurement)

3. Categories of processed data

  • Master data (name, address), contact data (e-mail, telephone number)
  • Contract and order data (products, prices, payment and shipping information, invoice data)
  • Account and login data (if customer account is created)
  • Usage, log and device data (IP address, access time, user agent, referrer, cookies/consent status)
  • Geodata at country level for price/dispatch determination (see section 11)

4. Hosting, security & content delivery

We use professional hosting and security services for secure and efficient provision. Among other things, IP addresses, time stamps, retrieved content and error logs are processed to ensure the operation, availability and security of the website. The legal basis is Art. 6 para. 1 lit. f GDPR.

5. Server log files

Server log files (IP address in abbreviated or complete form, date/time, retrieved file/URL, amount of data transferred, notification of successful retrieval, browser type and version, operating system) are automatically saved each time a page is accessed. The log files are stored for a short period of time for security reasons (e.g. to investigate misuse or fraud) and then deleted. Legal basis: Art. 6 para. 1 lit. f GDPR.

6. Cookies, consent management & revocation

We use cookies and similar technologies. Necessary cookies are essential for operation (Art. 6 para. 1 lit. f GDPR). For statistics/marketing technologies, we obtain your consent in advance (Art. 6 para. 1 lit. a GDPR).

You can change or revoke your consent at any time with effect for the future (e.g. via the cookie settings in the footer or your browser/device configuration menu).

7. Web analytics (Google Analytics 4) & consent mode

If you consent, we use Google Analytics 4 to measure reach. Usage data (e.g. page views, interactions) is processed; IP addresses are truncated. We use Google Consent Mode, which only sends aggregated, cookie-free pings in the absence of consent. Legal basis: Art. 6 para. 1 lit. a GDPR.

Recipient: Google Ireland Limited (processing in the EU) and, if applicable, Google LLC (USA). Transfers to third countries take place on the basis of suitable guarantees (e.g. standard contractual clauses). Storage duration of event data in GA4: generally 2-14 months (depending on configuration).

8. Tag management (Google Tag Manager)

The Google Tag Manager is used for the central administration of scripts/tags. The GTM itself does not process any user data for its own purposes; downstream services are only triggered in accordance with your consent. Legal basis: Art. 6 para. 1 lit. f or lit. a GDPR (depending on the tag).

9. Marketing/conversion measurement (Google Ads)

With your consent, we use Google Ads conversion measurement and - if applicable - remarketing. Interaction data is processed in order to measure the effectiveness of ads and (if activated) to display targeted advertising. Legal basis: Art. 6 para. 1 lit. a GDPR.

Enhanced Conversions: If you give your consent as part of the purchase, hashed contact details (e.g. email, hashed with SHA-256) can be transmitted to Google in order to assign orders with advertising clicks. This improves the accuracy of measurement without transmitting plain text. Legal basis: Art. 6 para. 1 lit. a GDPR.

10. Store functions (WooCommerce) & country prices

We use WooCommerce to process orders. We process the data you enter to fulfill the contract (Art. 6 para. 1 lit. b GDPR).

For a correct price/tax/shipping display, we use country detection based on the IP address and/or browser/checkout details (e.g. "Price Based on Country"). No exact movement profile is created; geolocalization takes place at country level. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in correct presentation of offers).

11. Customer account

You can voluntarily create a customer account. The processing of the data required for this serves the purpose of convenient order processing and administration of your data. Legal basis: Art. 6 para. 1 lit. b GDPR. You can delete the account at any time; statutory retention obligations remain unaffected.

12. Payment processing (Stripe)

Depending on the method selected, payments are processed via the payment service provider Stripe. For this purpose, payment data, name, billing address and, if applicable, e-mail/telephone are transmitted to Stripe. Legal basis: Art. 6 para. 1 lit. b (contract), lit. f (fraud prevention), possibly lit. c (legal obligations) GDPR.

Recipient: Stripe Payments Europe, Ltd (EU) and, if applicable, affiliated Stripe companies (including USA). Transfers outside the EEA are made on the basis of suitable guarantees (e.g. standard contractual clauses).

13. Shipping, fulfillment & tracking

In order to fulfill the contract, we transmit the data required for shipping (name, address, e-mail/telephone for delivery information if applicable) to transport/logistics companies (e.g. DHL, DPD, UPS). Legal basis: Art. 6 para. 1 lit. b GDPR.

A fulfillment/back-office service provider may be used for order processing/automation (e.g. Billbee GmbH) and a shipment tracking service (e.g. "Parcel Panel"). Processing takes place within the framework of order processing in accordance with Art. 28 GDPR.

14. Product reviews & trust services (Trusted Shops)

A trust badge/widget from Trusted Shops may be integrated on our site to display ratings/trust signals and, if applicable, to send invitations to submit ratings (after purchase). Pseudonymous data (e.g. order/email hash) may be used for verification purposes. The legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR) in a trustworthy presentation and - for rating invitations - Art. 6 para. 1 lit. a/b GDPR.

15. Languages & translation (TranslatePress)

We use a translation plugin for multilingual provision. It can store a functional cookie (e.g. language preference) to display the website in the language you have selected. Legal basis: Art. 6 para. 1 lit. f GDPR.

16. Communication (e-mail support)

If you contact us by e-mail, the data you provide will be processed for the purpose of processing your request. Legal basis: Art. 6 para. 1 lit. b or lit. f GDPR.

17. Data recipients, processors & third country transfers

We use carefully selected service providers (processors) for hosting, security, shipping, payment processing, shop/analytics/marketing functions. We have contracts with all service providers in accordance with Art. 28 GDPR.

If data is processed outside the EEA (e.g. USA, UAE), this only takes place if an adequacy decision exists or suitable guarantees are in place (e.g. EU standard contractual clauses) and additional protective measures are taken.

18. Storage period

  • Contract/order data: statutory commercial/tax periods (generally up to 10 years)
  • Customer account: until the account is deleted (provided there are no longer legal obligations to the contrary)
  • Contact requests: until final processing, then regular check for deletion requirements
  • Analysis/marketing data: in accordance with the respective tool configuration and until you withdraw your consent
  • Server logs: short-term (security/error analysis) and subsequent deletion/anonymization

19. Obligation to provide

The provision of personal data is necessary for the conclusion of a contract/order. Without this data, an order/contract processing is not possible. There is no obligation for optional analytics/marketing; these are only carried out with consent.

20. Your Rights

You have the following rights under the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6 (1) (e) or (f) (Art. 21). If the processing is based on consent, you can withdraw this consent at any time with effect for the future (Art. 7 para. 3).

To exercise your rights, simply send an informal message to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.

21. Minors

Our offer is not aimed at children. If we become aware of the processing of personal data of minors without the required consent, we will delete this data immediately.

22. Data Security

We take technical and organizational measures to protect personal data against loss, destruction, access, modification or dissemination by unauthorized persons (e.g. TLS encryption, access restrictions, backups).

23. Responsible party

Lazru Cosmetics Trading L.L.C
NGI Building, Office 902-34
Port Saeed, Dubai, VAE (UAE)
PO Box 12887
E-Mail: [email protected]

24. Changes to this privacy policy

We will adapt this declaration if the legal situation, services or processing changes. The current version is available on this page.

Status: August 27, 2025