Free shipping in Germany from €100
Malak

Privacy Policy

1. Data Controller

Malak Bekleidung
Owner: Mohammad Albraqi
Pannierstr. 4, 12047 Berlin, Germany
Email: info@malak-bekleidung.com
Phone: +49 157 78413511

2. Collection and Storage of Personal Data

When you visit our website, the web server automatically collects: IP address, date and time of request, page accessed, browser type and version, operating system. This data is collected to ensure smooth operation and is deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR.

3. Orders and Customer Account

For contract processing, we collect: name, address, email, phone number, payment data, order history. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment). We store order data for 10 years in accordance with German tax law.

4. Payment Service Providers

We use the following payment providers to whom data is transmitted for payment processing:

  • Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) — Credit card payments. Privacy: https://stripe.com/privacy
  • PayPal (PayPal (Europe) S.à r.l. et Cie, Luxembourg) — Privacy: https://www.paypal.com/webapps/mpp/ua/privacy-full
  • Klarna (Klarna Bank AB, Stockholm, Sweden) — Privacy: https://www.klarna.com/international/privacy-policy/
  • SumUp (SumUp Limited, Dublin, Ireland) — Privacy: https://www.sumup.com/privacy/

5. Shipping Provider

We use DHL (Deutsche Post DHL Group) for shipping. We transmit name, address, and if applicable, phone/email to DHL for delivery.

6. Email Service

For sending confirmation, status, and service emails, we use Resend (Resend Inc., San Francisco, USA). Data transfer to the US is based on EU Standard Contractual Clauses.

7. Hosting and Data Storage

  • Supabase — Database hosting. Server location: Frankfurt (EU)
  • Cloudflare R2 — Image storage
  • Vercel — Website hosting

8. Analytics and Tracking

We use PostHog for web analytics, exclusively with your explicit consent (Art. 6(1)(a) GDPR). PostHog servers are located in the EU (Frankfurt). No data is shared with third parties. You can revoke your consent at any time via the cookie settings.

9. Advertising and Conversion Tracking (Meta, TikTok)

If you accept the "Marketing" category in the cookie banner, we load the advertising pixels of Meta and TikTok. They measure which products you view, add to your cart or buy, so that we can show you relevant ads and measure the success of our campaigns. Event and product data is sent to the pixels (e.g. items, cart value, order value); when the pixels load, Meta and TikTok also receive your IP address and browser data, and cookies or similar identifiers are stored on your device. Both pixels can also pick up your email address, phone number and customer ID with us – the Meta pixel additionally your first and last name, city, postcode and country – on our pages (e.g. from forms), hash them in your browser and send them to Meta or TikTok only in this hashed form ("advanced matching"). When you make a purchase, we also send the following to Meta via the Meta Conversions API: in hashed form your email address, phone number, first and last name, postcode, city, country and your customer ID with us; unhashed your IP address, your browser identifier (user agent) and Meta's cookie and ad-click identifiers (fbp, fbc). This lets Meta and TikTok attribute your purchase to the right ad. All of this happens solely with your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time via the cookie settings.

10. Cookies

We use:

  • Strictly necessary cookies (cart, language, authentication) — Legal basis: Art. 6(1)(f) GDPR
  • Analytics cookies (PostHog) — only with consent, Art. 6(1)(a) GDPR

11 Reach measurement – cookieless visitor counting

To anonymously measure the reach of our online shop (number of
visitors, source of traffic) we use a cookieless method. No cookies
are set and no data whatsoever is stored on or read from your device.

On each page view, a daily, irreversible checksum is calculated from
your IP address and your browser identifier (user agent), using
HMAC-SHA256 with a secret daily key. We store only: this checksum, the
date, a traffic-source category (e.g. search engine, social media,
referral, direct) and the number of page views. Your IP address, your
user agent and the full referrer are never stored.

The secret daily key is random and is irreversibly deleted at the end
of each day. As a result, a checksum can be linked neither to a person
nor across multiple days, and the IP address cannot be reconstructed
from the checksum. Automated requests (search-engine bots and similar)
are detected and counted separately.

As your device is never accessed, no consent under Section 25 TDDDG is
required. The brief processing of your IP address to calculate the
checksum is based on our legitimate interest in data-minimising reach
measurement (Art. 6(1)(f) GDPR). The aggregated counting data is
deleted after 180 days and is not passed on to third parties;
processing takes place on servers within the EU.
You can change your cookie settings at any time via the "Cookie Settings" link in the footer.

12. Your Rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR) — Right to be forgotten
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)

You can delete your account and all personal data at any time in your account settings. To exercise your rights, contact: info@malak-bekleidung.com

13. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority.

14. SSL Encryption

This website uses SSL encryption for security purposes and to protect the transmission of personal data.

15. Phone number and WhatsApp

At checkout you may give us your phone number. We use it only for questions about your order. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
With the WhatsApp buttons on our website you write to us yourself; the order number is already filled in. The legal basis is Art. 6(1)(b) GDPR.
We send you WhatsApp messages about your order (for example about shipping and delivery) only if you tick the box at checkout. The legal basis is your consent (Art. 6(1)(a) GDPR). We write these messages by hand in the WhatsApp Business app. We store when you consented, which text you saw and whether you withdrew.
In the WhatsApp Business app, an AI assistant from Meta may answer messages automatically. A member of our team can take over the conversation at any time.
In the EU, WhatsApp is provided by WhatsApp Ireland Limited (Ireland). Data may be transferred to Meta Platforms, Inc. in the USA. The basis for this is the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). WhatsApp's own terms and privacy policy also apply to your use of WhatsApp.
You can withdraw your consent at any time: by replying “STOP” in WhatsApp, on the order page in your account, or via the link in the order e-mail. The withdrawal applies from then on.
We store your phone number with the order. If you ask us to delete your data, we delete it from your orders and from the record of your consent. We keep the record itself (time, text version, withdrawal) without the number, to be able to prove the consent (Art. 7(1) GDPR).
We do not use your phone number for advertising and we do not send text messages (SMS).

Last updated: April 2026