Privacy Policy

Radhe Foods — Online Shop

Effective date: [DATE]

1. Data Controller

The controller responsible for processing personal data through this online shop is:

[REGISTERED LEGAL BUSINESS NAME], trading as Radhe Foods
Address: [FULL BUSINESS ADDRESS, GERMANY]
Email: [PRIVACY CONTACT EMAIL]
Website: https://shop.radhefoods.de

Data protection officer, if appointed: [CONTACT DETAILS OR REMOVE IF NOT APPLICABLE]

2. Personal Data We Process

Depending on how customers use the shop, we may process:

• Name, email address, telephone number, billing and delivery addresses.
• Account information, including login credentials stored using appropriate security protections.
• Order contents, quantities, transaction references, invoices, delivery status, cancellations and refunds.
• Customer-service correspondence and support requests.
• Technical information such as IP address, browser information, device details, timestamps and server logs.
• Shopping-cart, language-preference and wishlist information, including information stored locally on the customer's device.

We collect personal data only where needed for the stated purposes or where another lawful basis applies.

3. Purposes and Legal Bases

We process personal data for:

Orders and delivery: Creating and fulfilling contracts, receiving payment, processing orders, delivering goods, and providing customer support. Legal basis: Article 6(1)(b) GDPR.

Accounts and authentication: Managing customer accounts, sign-in, password resets and account security. Legal bases: Article 6(1)(b) and, where applicable, Article 6(1)(f) GDPR.

Accounting and legal compliance: Maintaining legally required invoices, accounting records and other documents. Legal basis: Article 6(1)(c) GDPR.

Website operation and security: Maintaining the technical service, identifying errors, protecting against misuse and investigating security incidents. Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in operating a reliable and secure shop.

Optional technologies and communications: Where required, we request consent before using non-essential cookies, analytics, marketing technologies or promotional communications. Legal basis: Article 6(1)(a) GDPR and applicable telecommunications privacy law. Consent may be withdrawn at any time.

4. Customer Accounts and Guest Checkout

Customers may use guest checkout where offered or create an account by providing the required registration information.

We process account information to provide authentication, order history, password recovery, account management and customer communications.

Order information that must be retained for statutory purposes may remain stored after account deletion.

5. Payments Through Stripe

Our online shop uses Stripe Checkout to process supported payment methods, including cards and PayPal where enabled.

During payment, Stripe receives information required to process the transaction, which may include customer details, transaction amounts, payment information and technical information.

Radhe Foods receives payment status information, transaction identifiers and information necessary for order fulfilment, accounting and refunds.

Payment processing is subject to the applicable privacy information provided by Stripe and, where relevant, PayPal.

Stripe privacy information: https://stripe.com/privacy

6. Hosting and Service Providers

To operate the online shop, we use external technical and service providers. The following providers must be confirmed against our actual production configuration before this policy is published:

• Vercel — website frontend hosting and delivery.
• Hostinger — backend application hosting.
• MongoDB Atlas — application database services.
• Amazon Web Services, including S3 and Simple Email Service (SES) — where enabled for file storage and transactional email.
• Stripe — payment services.
• [ACTUAL SHIPPING / COURIER PROVIDERS] — delivery of customer orders.

We share personal information with these providers only to the extent necessary for the respective service and subject to applicable data protection requirements.

7. International Data Transfers

Some service providers may process or access personal data outside the European Economic Area.

Where such transfers occur, they must comply with GDPR requirements, including applicable adequacy decisions, standard contractual clauses or other legally permitted safeguards.

[VERIFY AND INSERT THE ACTUAL THIRD-COUNTRY TRANSFERS, TRANSFER SAFEGUARDS AND HOW CUSTOMERS CAN OBTAIN DETAILS.]

8. Cookies and Local Storage

We use technologies needed for the operation of the online shop, including functions supporting sessions, authentication, security, shopping carts and language preferences.

Certain shopping-cart or wishlist information may be stored locally on the customer's device.

Optional analytics, advertising or similar technologies are used only where legally permitted and subject to consent where required.

[ADD A VERIFIED LIST OF COOKIES AND LOCAL-STORAGE ITEMS, INCLUDING PURPOSE, PROVIDER, DURATION AND WHETHER CONSENT IS REQUIRED.]

9. Transactional Emails and Marketing

We may send transactional messages relating to registration, account security, order confirmation, delivery, payments, invoices, refunds and customer-support requests.

Marketing emails are sent only where a valid legal basis exists, including consent where required. Customers can withdraw consent or object to marketing communications at any time.

[CONFIRM WHETHER NEWSLETTERS OR OTHER DIRECT MARKETING ARE ACTUALLY USED.]

10. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected or as required by law.

German legal retention periods depend on the document type. For example, certain accounting records and invoice copies are subject to statutory retention periods, including eight years for invoices and some accounting documents, six years for certain business correspondence, and ten years for certain business records.

Other customer account, support, technical-log and temporary checkout data are deleted or anonymized under the applicable retention rules.

[CONFIRM ACTUAL RETENTION PERIODS FOR SERVER LOGS, ACCOUNTS, INCOMPLETE CHECKOUTS, AND SUPPORT REQUESTS.]

11. Sharing of Personal Data

We do not sell customers' personal data.

Personal data may be shared with payment providers, logistics providers, hosting and database providers, professional advisers or public authorities where necessary and legally justified.

12. Your GDPR Rights

Subject to applicable legal conditions, individuals have the right to:

• Access their personal data.
• Request rectification of inaccurate information.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests.
• Receive data in a portable format where applicable.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with a competent data protection supervisory authority.

Requests may be directed to [PRIVACY CONTACT EMAIL].

13. Automated Decision-Making

[CONFIRM WHETHER ANY AUTOMATED DECISIONS WITH LEGAL OR SIMILARLY SIGNIFICANT EFFECTS OCCUR, INCLUDING THROUGH PAYMENT FRAUD SCREENING, AND DISCLOSE AS REQUIRED.]

14. Data Security

We use appropriate technical and organizational measures intended to protect personal data against unauthorized access, loss, alteration and misuse.

No online service can guarantee absolute security.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, technical systems or applicable laws. The current version will be published on our website.

For privacy-related questions, please contact [PRIVACY CONTACT EMAIL].