Privacy policy

Privacy Policy

This Privacy Policy applies to the website www.calessa.com operated by Calessa (“we”, “us”, “our”). It complies with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and applicable German and European data protection laws. This policy explains how we collect, store, process, and protect your personal data when you visit our website, register an account, or place an order, as well as your legal data protection rights as a resident of the European Union and Germany.
By using our website and services, you consent to the data processing practices described in this Privacy Policy.

1. Data Controller

The data controller responsible for your personal data is Calessa.
Website: www.calessa.shop
Email: hello@calessa.shop
Phone: +49 821 5674164
Address: Luisenstraße 17, 90478 Nürnberg, Germany
You may contact us at any time for data access requests, correction, deletion, data portability, or privacy-related complaints.

2. Personal Data We Collect

We only collect data that is necessary for the performance of our services and contractual obligations, in accordance with GDPR and German data protection rules:
  • User-provided Data: Full name, email address, contact phone number, billing and delivery address, postal code, order details, customer support messages, return and refund requests.
  • Transaction Data: Order history, payment confirmation records, and purchase preferences. We do not store full credit card details. All payments are processed by EU-regulated payment service providers compliant with PCI DSS standards.
  • Technical Data: IP address, browser type, device information, website access logs, and cookie data used for website optimisation, security improvement, and fraud prevention.

3. Purpose & Legal Basis of Data Processing

We process your personal data based on contractual necessity, legitimate interest, and your consent as required by GDPR:
  • To process, fulfill, and deliver your orders within Germany and the European Union
  • To provide customer service, answer enquiries, and handle after-sales and return matters
  • To send order confirmations, shipping updates, and service notifications
  • To ensure website security and prevent fraudulent transactions
  • To send marketing content only with your explicit opt-in consent
  • To retain financial and business records to comply with German commercial and tax law requirements

4. Data Sharing with Third Parties

We will never sell or trade your personal data. We only share necessary data with EU-based and GDPR-compliant third-party service providers, including payment processors, logistics and shipping providers, website hosting services, and analytics tools. All partners are contractually required to protect your data in compliance with GDPR and German data protection regulations.

5. Cookies

Our website uses cookies to improve user experience. You may manage, disable, or delete cookies via your browser settings. All cookie usage complies with EU ePrivacy Directive and German online data protection requirements.

6. Your GDPR & German Data Protection Rights

You have the right to access your personal data, correct inaccurate data, request erasure, restrict processing, data portability, withdraw consent at any time, and lodge a complaint with a German data protection authority if you believe our processing violates data protection laws.

7. Data Retention

We store personal data only for as long as necessary. Order and financial records are retained in accordance with German tax and commercial law retention obligations. Customer service data is stored until the case is fully resolved, and marketing data is deleted upon your opt-out request.

8. Data Security

We use SSL encryption, secure server infrastructure, and strict internal access controls to protect your personal data. We take appropriate technical and organisational measures to prevent data loss, unauthorised access, and data breaches in compliance with GDPR and BDSG.

9. Minors Protection

Our website and products are intended for users aged 18 and over. We do not knowingly collect personal data from minors. If we receive information concerning minor data, we will delete it immediately.

10. Policy Updates

We may update this Privacy Policy to comply with changes in EU and German data protection legislation. Updates will be published with the latest revision date.