Privacy Policy

1. Controller

The controller responsible for data processing on this website under the GDPR is Francielly de Araujo Chaves, MOMENTUM, Bornimer Straße 6, Aufgang 2, 10711 Berlin, email: info@momentumgiftbox.com, phone: +49 160 95833227.

2. General

We process personal data only insofar as necessary to provide the website, perform the contract, based on your consent or due to legal obligations. Legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests). Section 25 TDDDG additionally applies to cookies and similar technologies. We delete data when the purpose no longer applies and no statutory retention obligations exist.

3. Hosting via Vercel

Our website is hosted by Vercel Inc., address according to the DPA, USA. When the website is accessed, Vercel processes data such as IP address, browser, operating system and time of access in server log files. Delivery is via servers in Frankfurt am Main (fra1 region); access from the USA cannot be excluded. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. We have a data processing agreement (DPA) with Vercel.

3a. Database (Supabase)

Data collected for order processing is stored in a database operated by Supabase Inc., address according to the DPA, USA. The project is located in the European Union (Paris). The legal basis is Art. 6(1)(b) GDPR. Access from the USA cannot be excluded; transfers are based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. We have a data processing agreement (DPA) with Supabase.

4. Cookies and consent management

We use technically necessary cookies (legal basis: Section 25(2) TDDDG, Art. 6(1)(f) GDPR). All other cookies and technologies (analytics, marketing, external services) are used only after your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw consent at any time with effect for the future by adjusting your cookie settings via the banner or the corresponding footer link.

5. Contact (contact form, email, WhatsApp)

When you contact us via the contact form or email, we process your details (name, contact details, message) to handle your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once the enquiry is resolved and no retention obligations apply.

We offer communication and ordering via WhatsApp Business (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). Use is voluntary; you can alternatively contact us by email or telephone. Message content is end-to-end encrypted; metadata (e.g. telephone number, time) is processed by WhatsApp/Meta, including in third countries. WhatsApp's privacy policy also applies. The legal basis is Art. 6(1)(b) or (f) GDPR.

6. Order processing and delivery

For order processing we process name, billing and delivery address, telephone number, email address, order contents, delivery date and, where provided, card text and allergy information concerning the recipient (Art. 6(1)(b) GDPR). Recipient information you provide is used solely for delivery. As the ordering party, you are responsible for being authorised to transmit this data. Due to commercial and tax requirements, accounting and invoice records are stored for up to ten years (Art. 6(1)(c) GDPR).

7. Payment processing

For PayPal payments, your payment data is transmitted to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg) (Art. 6(1)(b) GDPR). PayPal's privacy provisions apply. For bank transfers, we process the payment data necessary for the transfer that your bank provides to us. If further payment services are offered in checkout in the future, the necessary data will likewise be transmitted to the relevant provider solely for payment processing.

8. Google Analytics

With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse and improve use of our website. Usage data (e.g. pages viewed, time spent, device and browser information and approximate location) is collected using cookies and similar technologies. A transfer to Google LLC in the USA may take place on the basis of the EU-US Data Privacy Framework. Data is stored for the retention period configured in our account (maximum 14 months). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time.

9. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager is used to manage and deploy the tags we use. It is used only after your consent. When loaded, your IP address may be transmitted to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

10. Microsoft Clarity

With your consent, we use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity creates pseudonymised session recordings and heatmaps, including mouse movements, clicks, scrolling, time spent, screen resolution, browser and device information and approximate location. Form-field inputs are masked. Transfers to the USA are possible and are based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time.

11. Meta Pixel

With your consent, we use the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). The pixel records your interactions with our website (for example pages viewed, products viewed, adding to the basket, submitting an order enquiry) as well as your IP address and browser and device information. We use this data to measure the effectiveness of our advertising and to show you interest-based advertising on Facebook and Instagram, including the creation of audiences (custom and lookalike audiences). For the collection of this data and its transmission to Meta, we are jointly responsible with Meta within the meaning of Art. 26 GDPR; the essential content of that arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing. Transfers to Meta Platforms, Inc. in the USA may take place on the basis of the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time with effect for the future.

12. Instagram

We operate an Instagram profile (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and link to it. When visiting our profile, Meta processes data under its own privacy policy. For statistical analysis of our profile (Insights), we are jointly responsible with Meta within the meaning of Art. 26 GDPR. If you message us via Instagram, we process your message to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

13. Recipients and retention

Data is disclosed only to the service providers named above, to authorities where legally required, and to our tax adviser if appointed. We retain personal data only for as long as necessary for the stated purposes or as required by statutory retention periods.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Consent may be withdrawn at any time with effect for the future. To exercise your rights, contact info@momentumgiftbox.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, email: mailbox@datenschutz-berlin.de.

15. Provision of data and automated decision-making

Providing the data required for an order is necessary to conclude and perform the contract. Without this data, we cannot fulfil the order. No automated decision-making, including profiling, takes place.

16. Changes

We will adapt this Privacy Policy if our services or the legal situation changes. The current version published on our website applies.