Privacy Policy

Updated: September 2026

1. Controller

The controller within the meaning of the GDPR is:

Madgems GmbH
Motschental 22
96450 Coburg
Germany

Represented by the Managing Directors: Alexander Rosenberg, Marc Saul, Marcel Günther
Email: support@madgems.de
WhatsApp: +49 176 32874345
Commercial Register: Coburg Local Court, HRB 7514

We have not appointed a Data Protection Officer, as the statutory requirements under Section 38 of the German Federal Data Protection Act (BDSG) do not apply to us. For all matters relating to data protection, you can contact us using the contact details provided above.

2. General Information on Data Processing

We process personal data only insofar as this is necessary to provide our online shop, content and services or where you have given your consent. Personal data means any information relating to an identified or identifiable natural person.

The legal bases for our processing include in particular:

  • Art. 6(1)(a) GDPR – your consent

  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures

  • Art. 6(1)(c) GDPR – compliance with legal obligations

  • Art. 6(1)(f) GDPR – pursuit of our legitimate interests

3. Hosting and Shop System (Shopify)

Our online shop is operated using the Shopify platform.

Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland

Shopify provides the technical infrastructure and processes personal data on our behalf, including order, customer and usage data. We have entered into a data processing agreement with Shopify pursuant to Art. 28 GDPR. Data may be transferred to third countries, in particular the USA and Canada, on the basis of the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of our online services).

4. Server Log Files

When you access our website, the following data is automatically collected:

  • IP address

  • date and time of access

  • page or file accessed

  • amount of data transferred

  • referrer URL

  • browser type and version

  • operating system

This data is used for technical provision of the website, system security and error analysis. It is not combined with other data sources.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and uninterrupted operation).

Retention period: 30 days.

5. Cookies, Similar Technologies and Consent Management

We use cookies, pixels, tags, local storage technologies and comparable technologies on our website.

Technically necessary technologies are used insofar as they are required for the operation of the shop, processing of orders, security, storage of your language settings or storage of your privacy preferences.

The legal basis for accessing or storing information on your terminal device is Section 25(2) No. 2 TDDDG. Where personal data is processed in this context, the processing is based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

Non-essential technologies for statistics, analytics, reach measurement, conversion measurement, personalised advertising, remarketing or the creation of target audiences are used only after your prior consent.

The legal basis for this is Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Through our consent management system, you can choose in particular between necessary, analytics and marketing technologies. You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

Refusing or subsequently withdrawing your consent does not affect the basic use of our shop.

Where we use server-side technologies such as Conversion APIs, Events APIs or Enhanced Conversions through which data is transmitted to third parties for analytics or advertising purposes, this also takes place only within the scope of the consent you have provided.

Shopify provides an overview of the cookies and comparable technologies used by Shopify itself at:

https://www.shopify.com/legal/cookies

6. Order Processing and Customer Account

To process your order, we process:

  • name, billing and delivery address

  • email address and, where applicable, telephone number

  • payment and order data

  • where applicable, login details for your customer account

The data is disclosed to service providers involved in fulfilling the contract, such as payment service providers, shipping service providers and tax advisers, where this is necessary.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and, for invoice data, additionally Art. 6(1)(c) GDPR.

Retention period: We retain contractual and invoice data for 6 or 10 years due to statutory commercial and tax retention obligations under Section 257 HGB and Section 147 AO. You may request deletion of your customer account at any time; statutory retention obligations remain unaffected.

7. Payment Service Providers

Depending on the payment method selected, we transfer your payment data to the relevant payment service provider. These providers process the data as independent controllers in accordance with their respective privacy policies.

We use:

  • Shopify Payments (Shopify International Limited, Ireland)

  • PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg)

  • Klarna (Klarna Bank AB, Sweden)

  • Apple Pay (Apple Distribution International Ltd., Ireland)

  • Google Pay (Google Ireland Limited, Ireland)

  • Bancontact, EPS, iDEAL, Wero, MobilePay, Maestro, Mastercard, Visa, UnionPay, Shop Pay

Legal basis: Art. 6(1)(b) GDPR.

8. Shipping

For delivery of your order, we transmit your name, delivery address and, where required for shipment tracking, your email address and telephone number to the commissioned shipping company.

Shipping providers: DHL, Post and FedEx

Legal basis: Art. 6(1)(b) GDPR.

9. Contact

If you contact us by email, contact form or WhatsApp, we process the information you provide in order to handle your enquiry.

Information regarding WhatsApp: The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. When using WhatsApp, metadata is transmitted to the provider and may be transferred to third countries. If you wish to avoid this, please contact us by email instead.

Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries; otherwise Art. 6(1)(f) GDPR.

Retention period: Until your enquiry has been fully processed, unless statutory retention obligations require longer storage.

10. Newsletter

We use the double opt-in procedure for sending our newsletter. After registering, you will receive an email containing a confirmation link. You will only be added to the mailing list after confirming your registration. The time of registration and IP address are logged for verification purposes.

You can unsubscribe from the newsletter at any time using the unsubscribe link contained in each email.

Email service provider: Shopify Messaging

Legal basis: Art. 6(1)(a) GDPR (consent); logging for verification purposes is based on Art. 6(1)(f) GDPR.

11. Web Analytics, Conversion Measurement and Online Marketing

Following your consent, we may use analytics and marketing services from various providers. The services that are technically activated depend in particular on the marketing and advertising channels we use.

In this context, the following data in particular may be processed:

  • IP address

  • browser and device information

  • operating system

  • referrer URL and URLs accessed

  • date and time of access

  • cookie, device and advertising IDs

  • information about page views and clicks

  • product views

  • searches

  • shopping cart events

  • start and completion of an order process

  • order value, currency and transaction information

  • information about the advertisement or campaign through which you reached our website

Where so-called enhanced matching procedures, Advanced Matching, Enhanced Conversions or server-side conversion interfaces are used, contact information provided by you, such as your email address or telephone number, may additionally be transmitted to the relevant provider in hashed form. Depending on the service used, your name, address or location information may also be used for data matching.

This data is used in particular to measure the reach of our website, analyse user behaviour, measure advertising campaigns, attribute purchases to advertisements, create target audiences, conduct remarketing and optimise and personalise advertising.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or accessed from your terminal device, Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future via the cookie settings on our website.

11.1 Shopify Analytics

We use Shopify analytics functions to evaluate the use of our online shop.

The provider is Shopify International Limited, Ireland.

In particular, page views, sessions, devices and browsers used, source of visits, product interactions, shopping cart events and purchases may be processed.

The data is used to analyse and improve our shop and to measure our sales and marketing activities.

11.2 Google Analytics

We may use Google Analytics to analyse the use of our website.

The provider for users in the European Economic Area is Google Ireland Limited.

Google Analytics allows us to analyse in particular page views, sessions, user interactions, source of visits, device information, product interactions, shopping cart events and purchases.

Google may combine the information collected with other data insofar as this is permitted under your settings and consent.

Data may also be processed by affiliated companies and service providers outside the European Economic Area.

11.3 Google Ads, Conversion Tracking, Remarketing and Enhanced Conversions

We may use Google Ads, including Conversion Tracking, Remarketing and Enhanced Conversions.

The provider is Google Ireland Limited.

This enables us to determine whether users perform certain actions on our website after clicking on or viewing one of our advertisements, for example viewing products, adding items to their shopping cart or completing a purchase.

Target audiences may also be created for repeated or personalised advertising.

When Enhanced Conversions are used, data provided by you, such as your email address or telephone number, may be hashed before transmission and used for matching with Google accounts.

Google may use cookies, advertising IDs and other identifiers for these purposes.

11.4 Google Tag Manager

We may use Google Tag Manager to manage analytics, marketing and conversion tags.

The provider is Google Ireland Limited.

Google Tag Manager is used in particular to technically control tracking and marketing services used on our website. Services integrated via Tag Manager are activated or blocked in accordance with your consent decision.

Where services requiring consent are loaded via Google Tag Manager, this only takes place after the required consent has been given.

11.5 Meta Pixel, Meta Conversions API and Advanced Matching

We may use Meta Business Tools, in particular the Meta Pixel, Meta Conversions API and Advanced Matching.

The provider is Meta Platforms Ireland Limited.

These services are used in particular to measure the success of our advertisements on Facebook and Instagram, attribute purchases and other website events to advertisements, optimise our campaigns and create target audiences for remarketing and personalised advertising.

In particular, page views, product views, searches, shopping cart events, purchases, order values, URLs, referrers, IP addresses, browser and device information and cookie and advertising IDs may be processed.

Where Advanced Matching or the Conversions API is used, customer data provided by you, such as email address, telephone number, name or address, may additionally be transmitted to Meta in hashed or otherwise protected form.

Meta may match the transmitted data with existing Facebook or Instagram accounts and use it for measuring, optimising and personalising advertising.

Where we jointly determine the purposes and means of certain processing activities together with Meta, joint controllership pursuant to Art. 26 GDPR applies.

Processing of data by Meta companies outside the European Economic Area, particularly in the USA, cannot be excluded.

11.6 TikTok Pixel, TikTok Events API and Advanced Matching

We may use the TikTok Pixel, TikTok Events API and Advanced Matching.

The services are provided by TikTok or the TikTok companies responsible for TikTok Business products.

They are used in particular to measure the performance of our TikTok advertising, attribute website events to advertisements, optimise campaigns and create target audiences for remarketing and personalised advertising.

In particular, information about advertisements and events, page views, product views, shopping cart events, purchases, timestamps, IP addresses, browser and device information, cookies, URLs, page metadata and click information may be processed.

Where Advanced Matching is enabled, data provided by you, such as email address and telephone number, may additionally be processed in hashed form, as may other customer data where applicable.

TikTok may also process data outside the European Economic Area. This may include in particular the USA, Malaysia and Singapore, as well as other countries in connection with certain intra-group access.

11.12 X Pixel

We may use tracking and conversion technologies provided by the X platform.

These are used in particular to measure and optimise advertising campaigns, attribute conversions and create remarketing audiences.

In particular, website events, IP addresses, device and browser information, cookie and advertising IDs and information about previously displayed or clicked advertisements may be processed.

11.13 Third-Country Transfers in Connection with Analytics and Marketing Services

Some of the providers referred to above may process personal data outside the European Union or European Economic Area.

Where an adequacy decision by the European Commission exists for the relevant recipient country or company, the transfer is made on that basis. This applies in particular to US companies certified under the EU-US Data Privacy Framework.

Where no adequacy decision exists, data transfers are carried out in particular on the basis of the Standard Contractual Clauses approved by the European Commission or other safeguards provided for under Art. 46 GDPR.

Further information regarding data processing and retention periods is provided by the respective providers in their privacy policies.

Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

11.14 OpenAI Ads / ChatGPT Ads – Conversion Tracking

We use OpenAI Ads functions to measure and optimise our advertising campaigns within ChatGPT.

The provider for users in the European Economic Area is:

OpenAI Ireland Limited
1st Floor, The Liffey Trust Centre
117–126 Sheriff Street Upper
Dublin 1, D01 YC43
Ireland

For this purpose, we may use the OpenAI Pixel and the OpenAI Conversions API.

If you have previously consented to processing for marketing purposes, the following information in particular may be processed and transmitted to OpenAI:

  • pages and products viewed

  • product and variant identifiers

  • shopping cart contents

  • start and completion of checkout

  • order and purchase events

  • product names, quantities and prices

  • currency

  • time of the event

  • URL of the relevant page

  • browser and device information

  • IP address

  • pseudonymous or hashed online identifiers

  • where applicable, a hashed email address

  • OpenAI click references used to attribute a visit to a previous advertisement

When you click on an advertisement, OpenAI may append a click reference (“oppref”) to the destination URL. This reference may be stored and subsequently used to attribute later actions, in particular purchases, to an advertisement.

The processing is carried out for the purposes of measuring the effectiveness of our advertising, attributing conversions to advertising campaigns, creating campaign statistics and optimising our advertising activities.

The OpenAI Pixel and comparable non-essential storage or tracking technologies are activated only after you have given your express consent.

The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future via the cookie settings on our website.

OpenAI and we generally act as separate independent controllers in relation to the processing of personal data through the OpenAI Conversion Tools, unless OpenAI acts as a processor within the scope of expressly restricted processing.

For data relating to individuals in the European Economic Area, processing is carried out by OpenAI Ireland Limited. Where personal data is subsequently transferred to countries outside the European Economic Area, according to OpenAI such transfers are carried out on the basis of appropriate safeguards, in particular the European Commission's Standard Contractual Clauses.

Further information about data processing by OpenAI can be found in OpenAI's Privacy Policy at:

https://openai.com/en-GB/policies/eu-privacy-policy/

Reach – OpenAI Ads Pixel for Shopify

For the technical integration of the OpenAI Pixel and OpenAI Conversions API, we may use the Shopify app “Reach: OpenAI Ads Pixel”.

The provider is:

Inmediato LLC / Reach
16192 Coastal Highway
Lewes, Delaware 19958
USA

Reach processes events from our Shopify shop on our behalf and transmits them to OpenAI for conversion measurement purposes.

In particular, the following events may be processed:

  • page views

  • product views

  • adding products to the shopping cart

  • start of checkout

  • completed purchases

In particular, product information, shopping cart contents, prices, currency, timestamps and the URL accessed may be processed.

Where you have consented to marketing tracking, additional information may be processed to improve conversion attribution, including your IP address, browser information, pseudonymous or hashed identifiers and, for checkout and purchase events, a hashed email address.

Reach processes this data as a service provider on our behalf and transmits the information required for conversion tracking to OpenAI.

Processing for marketing and conversion tracking purposes takes place only after you have given your consent.

The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future via the cookie settings on our website.

As Reach is based in the USA and may use additional service providers outside the European Economic Area, personal data may be processed outside the EEA. Where required, such transfers are carried out on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

Further information about data protection at Reach is available at:

https://www.joinreach.ai/privacy

12. Social Media Profiles

We maintain profiles on Instagram, TikTok, YouTube and Twitch. When visiting these profiles, the privacy policies of the respective provider apply. We have only limited influence over the processing of data carried out there.

Links integrated into our website merely constitute references to the respective platforms; data is only transmitted once you click on such a link.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in public presentation and communication).

13. Transfers to Third Countries

Where data is transferred to countries outside the EU or EEA, we ensure an appropriate level of data protection through an adequacy decision of the European Commission, the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or your explicit consent pursuant to Art. 49(1)(a) GDPR.

14. Your Rights

You have the following rights in relation to us:

  • access to the personal data stored about you (Art. 15 GDPR)

  • rectification of inaccurate data (Art. 16 GDPR)

  • erasure (Art. 17 GDPR)

  • restriction of processing (Art. 18 GDPR)

  • data portability (Art. 20 GDPR)

  • objection to processing based on legitimate interests (Art. 21 GDPR)

  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object to direct marketing: You may object to the processing of your data for direct marketing purposes at any time without giving reasons. Following an objection, we will no longer process your data for these purposes.

To exercise your rights, it is sufficient to send an informal request to support@madgems.de.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 27
91522 Ansbach
Germany
https://www.lda.bayern.de

16. Data Security

We use SSL/TLS encryption when you visit our website. You can identify whether a page is transmitted in encrypted form by the padlock symbol in your browser's address bar.

17. Changes to this Privacy Policy

We amend this Privacy Policy if the legal situation, our services or our data processing activities change. The version published on this page at the relevant time applies.

This English version is provided for convenience only. In the event of any discrepancy, inconsistency or conflict between the English and German versions, the German-language version shall always prevail.