Privacy policy

Last updated: August 28, 2026

Merloan operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, as a customer, with our products and services (the “Services”). Our store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, process, and disclose personal data when you visit or use our website, make a purchase or other transaction using the Services, create an account, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy regarding the collection, processing, or disclosure of personal data, this Privacy Policy shall prevail.

Please read this Privacy Policy carefully to understand how and why we process your personal data.

Controller

For the purposes of applicable data protection laws, including the General Data Protection Regulation (GDPR), the controller responsible for the processing of your personal data is:

Angelique Schmalbrock
Merloan
Fliederstraße 5
89407 Dillingen a. d. Donau
Germany

Email: servicemerloan@gmail.com
Phone: +49 179 5902587

What Personal Data Do We Collect or Process?

When we use the term “personal data,” we mean information relating to an identified or identifiable natural person.

Depending on how you interact with the Services, we may collect or process the following categories of personal data:

  • Contact details, including your name, postal address, billing address, shipping address, telephone number, and email address.

  • Financial and payment information, including payment method, payment confirmation, transaction details, and other payment-related information. Payment information may be processed directly by the respective payment service provider.

  • Account information, including your username, password, account settings, preferences, and other information associated with your customer account.

  • Transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange, or cancel, as well as information relating to previous transactions.

  • Communications with us, including information you provide when contacting us, for example when submitting a customer service request.

  • Device and technical information, including information about your device, browser, network connection, IP address, and other technical identifiers.

  • Usage information, including information about how and when you access, interact with, or browse our website and Services.

Sources of Personal Data

We may collect personal data from the following sources:

  • Directly from you, for example when you place an order, create an account, use the Services, contact us, or otherwise provide us with your personal data.

  • Automatically through the Services, for example when you use our website, including through cookies and similar technologies where permitted by applicable law.

  • From Shopify and our service providers, where they process information in connection with providing services to us.

  • From business partners and other third parties, where permitted by applicable law.

How Do We Use Your Personal Data?

Depending on how you interact with us or which Services you use, we may process personal data for the following purposes:

  • Providing and fulfilling the Services. We process personal data to process and fulfil orders, process payments, arrange production and shipping, provide order information, facilitate returns and refunds, manage customer accounts, and otherwise perform our contractual obligations to you.

  • Customer service and communication. We process personal data to respond to inquiries, provide customer support, communicate with you about your orders or account, and maintain our business relationship with you.

  • Security and fraud prevention. We process personal data where necessary to protect our website, customers, business, and Services, to detect and prevent fraudulent, unlawful, unsafe, or malicious activity, and to maintain the security and integrity of our Services.

  • Improving our Services. Where permitted by applicable law, we may process information to understand how our Services are used, troubleshoot problems, improve functionality, and improve the customer experience.

  • Marketing and advertising. Where permitted by applicable law and, where required, based on your consent, we may process personal data to send marketing communications or to measure, personalize, and display advertising.

  • Compliance with legal obligations and establishment, exercise, or defence of legal claims. We may process personal data where necessary to comply with applicable laws, tax and accounting obligations, lawful requests from authorities, or to establish, exercise, or defend legal claims.

Legal Bases for Processing

If the GDPR applies to the processing of your personal data, we process your personal data only where there is a valid legal basis.

Depending on the particular processing activity, we rely on one or more of the following legal bases:

  • Performance of a contract or steps taken prior to entering into a contract (Art. 6(1)(b) GDPR): This applies in particular when we process information to process orders, payments, deliveries, returns, refunds, customer accounts, or pre-contractual inquiries.

  • Compliance with a legal obligation (Art. 6(1)(c) GDPR): This applies where processing is necessary to comply with legal obligations, including applicable tax, accounting, commercial, or regulatory requirements.

  • Legitimate interests (Art. 6(1)(f) GDPR): We may process personal data where necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your interests, rights, or freedoms. Such legitimate interests may include securing and operating our website and Services, preventing fraud and misuse, responding to inquiries, improving our Services, and establishing, exercising, or defending legal claims.

  • Consent (Art. 6(1)(a) GDPR): Where required by law, we process personal data based on your consent, for example for certain marketing activities or non-essential cookies and similar technologies. You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Cookies and Similar Technologies

Our website and the services provided through Shopify may use cookies and similar technologies.

Cookies and technologies that are strictly necessary for the operation of the website, shopping cart, checkout, security, and other essential functions may be used where permitted by applicable law without consent.

Non-essential cookies and similar technologies, including technologies used for analytics, personalization, or advertising, are used only where permitted by applicable law and, where required, after you have given your consent.

Where available, you can manage your privacy and cookie preferences through the cookie or privacy settings provided on our website. You may withdraw consent you have previously given at any time with effect for the future.

How Do We Disclose Personal Data?

We may disclose or provide personal data to third parties where this is necessary for the purposes described in this Privacy Policy and permitted by applicable law.

Recipients may include:

  • Shopify, which provides the ecommerce platform and related infrastructure used to operate our store.

  • Payment service providers, where necessary to process payments and prevent fraud.

  • Production, fulfilment, and shipping providers, where necessary to manufacture, fulfil, and deliver your order.

  • IT, hosting, analytics, customer support, and other service providers, where necessary to operate and improve our Services.

  • Business and marketing partners, where permitted by applicable law and, where required, based on your consent.

  • Public authorities, courts, regulators, or other parties, where disclosure is required by law or necessary for the establishment, exercise, or defence of legal claims.

  • Parties involved in a business transaction, such as a merger, acquisition, restructuring, or transfer of business assets, where permitted by applicable law.

We only disclose personal data to the extent necessary for the relevant purpose.

Relationship with Shopify

Our store is hosted by Shopify. Shopify collects and processes personal data relating to your access to and use of the Services in order to provide its ecommerce platform and related services.

Depending on the particular Shopify service or feature, Shopify may process personal data on our behalf as a processor or may process certain personal data for its own purposes as an independent controller.

Data submitted through our Services may be shared with Shopify and other service providers, including providers located outside your country of residence, where necessary to provide the Services.

If Shopify Network Intelligence or other Enhanced Services are enabled, Shopify may also process information collected from your interactions with our store, other merchants, and Shopify to provide enhanced functionality, personalization, analytics, and advertising services, subject to applicable law and your privacy choices.

For more information about Shopify’s processing of consumer personal data and the rights available to you, please see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Third-Party Websites and Links

Our Services may contain links to websites or online platforms operated by third parties.

If you follow a link to a website or service that is not operated or controlled by us, that third party’s own privacy policy and terms apply. We are not responsible for the privacy, security, accuracy, or content of third-party websites or services.

The inclusion of a link does not necessarily imply that we endorse the third-party website, its content, or its operator.

Children's Data

Our Services are not specifically directed at children, and we do not knowingly collect personal data directly from children who are not legally permitted to provide such data themselves under applicable law.

If you are a parent or legal guardian and believe that a child has provided personal data to us unlawfully, please contact us using the contact details below so that we can review the matter and, where required, delete the data.

Security of Your Data

We take appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

However, no method of transmission or storage can guarantee absolute security. We therefore cannot guarantee that information transmitted over the internet will always be completely secure.

Please do not send sensitive or confidential information through insecure communication channels.

Retention of Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, including the performance of contracts, provision of the Services, customer support, security, and the establishment, exercise, or defence of legal claims.

We may also retain personal data for longer periods where required by applicable legal, tax, accounting, or commercial retention obligations.

Once personal data is no longer required for the relevant purposes and no legal retention obligation or other lawful reason for continued storage applies, it will be deleted or anonymized as appropriate.

Your Rights and Choices

Depending on the law applicable to you, you may have rights regarding your personal data.

If the GDPR applies, these rights may include:

  • Right of access (Art. 15 GDPR). You may request information about whether and how we process your personal data and obtain a copy of your personal data.

  • Right to rectification (Art. 16 GDPR). You may request correction of inaccurate personal data and completion of incomplete personal data.

  • Right to erasure (Art. 17 GDPR). You may request deletion of your personal data where the applicable legal requirements are met.

  • Right to restriction of processing (Art. 18 GDPR). You may request restriction of the processing of your personal data in certain circumstances.

  • Right to data portability (Art. 20 GDPR). Where the applicable requirements are met, you may receive personal data you provided to us in a structured, commonly used, and machine-readable format or request transmission to another controller.

  • Right to object (Art. 21 GDPR). Where we process personal data based on legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

  • Right to withdraw consent. Where processing is based on consent, you may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

  • Right to lodge a complaint. You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

You may exercise your rights by contacting us using the contact details provided below.

We may need to verify your identity before processing certain requests where this is permitted or required by law.

You will not be discriminated against for exercising your applicable privacy rights.

Marketing Communications

If you have subscribed to promotional emails or other marketing communications, you may unsubscribe at any time using the unsubscribe option included in the relevant communication or by contacting us.

Even if you unsubscribe from marketing communications, we may continue to send non-promotional communications where necessary, for example information concerning your orders, account, customer service requests, or other contractual matters.

Privacy Choices for Targeted Advertising

Depending on where you live and the services enabled on our store, you may have additional rights or choices regarding the use or disclosure of personal data for targeted or personalized advertising.

Where available, you can exercise relevant privacy choices through our data sharing opt-out page or through the privacy settings provided on our website.

You may also be able to exercise certain rights relating to data processed by Shopify through the Shopify Privacy Portal.

Where applicable, recognized privacy preference signals may also be processed in accordance with applicable law and the functionality provided by Shopify.

Complaints

If you have questions or complaints about how we process your personal data, please contact us first using the contact details provided below.

If the GDPR applies to you, you also have the right to lodge a complaint with a competent data protection supervisory authority. You may in particular contact the supervisory authority responsible for your habitual residence, your place of work, or the place of the alleged infringement.

A list of European data protection supervisory authorities is available through the European Data Protection Board.

International Transfers

Some of our service providers, including Shopify and providers used in connection with ecommerce, payment, fulfilment, shipping, technical infrastructure, or other Services, may process personal data outside the European Economic Area (“EEA”).

Where personal data subject to the GDPR is transferred to a country outside the EEA that has not been recognized as providing an adequate level of data protection, appropriate safeguards are used where required by applicable law. These may include adequacy decisions adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or other legally recognized transfer mechanisms.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to our Services, data processing practices, legal requirements, or regulatory requirements.

When we update this Privacy Policy, we will publish the revised version on this website and update the “Last updated” date. Where required by applicable law, we will provide additional notice of material changes.

Contact

If you have questions about this Privacy Policy, our privacy practices, or the processing of your personal data, or if you would like to exercise any of your rights, please contact:

Angelique Schmalbrock
Merloan
Fliederstraße 5
89407 Dillingen a. d. Donau
Germany

Email: servicemerloan@gmail.com
Phone: +49 179 5902587

For the purposes of applicable data protection laws, including the GDPR, Angelique Schmalbrock, trading as Merloan, is the controller responsible for the processing of your personal data.