Privacy Policy

This notice explains how atharperfum.com processes information when you browse the site, use available shop features or contact us, and, where offered, place an order or pay online.

Controller and contact

Mhd Kheir Dabboura, trading as athar perfum
Halberstädter Str. 89, 39112 Magdeburg, Germany
Email: shop@atharperfum.com
Telephone: +49 1575 0167124

You can use these contact details for privacy requests.

Visiting and searching the website

Our hosting and content-delivery provider receives technical request data when you visit, such as your IP address, the requested page, request time and browser information. We use these data to deliver the website, keep it available and investigate misuse or technical problems. The legal basis is our legitimate interest in operating a secure, reliable website (GDPR Article 6(1)(f)). Search terms entered in the site search are sent to the site’s own search endpoint to return matching products.

Cart, accounts and browser storage

The shop provides a cart and sign-in for existing accounts. Public account registration is disabled. The cart service can issue an anonymous cart token and use browser storage needed to keep a cart available. WordPress and WooCommerce may use login or session cookies when you use the corresponding features. Account sign-in requires the credentials for that account; without them, sign-in is unavailable. We use these features to provide the service you request and protect accounts (GDPR Article 6(1)(b) or, for security, Article 6(1)(f)).

Contact and existing order records

If you email or call us, we process the contact details and message you provide to answer and handle your request. For questions about a possible or existing purchase, the basis is taking steps you request before a contract or performing it (GDPR Article 6(1)(b)); for other general enquiries it is our legitimate interest in responding (Article 6(1)(f)); and for a privacy-rights request it is our legal obligation (Article 6(1)(c)). The public Contact page provides email and telephone links, not a contact form. Email received at the shop address is held in a Hostinger mailbox.

If checkout is available and you place an order, we use the contact, billing, order and delivery details requested there to perform the purchase and fulfilment (GDPR Article 6(1)(b)) and keep legally required records (Article 6(1)(c)). Without the required checkout details, we cannot accept or deliver the order. If an earlier order or account record exists, we use it to handle the purchase, a related request, statutory records or a legal claim (Article 6(1)(b), (c) or (f), as applicable). The connected DHL Express Commerce service receives the order number, recipient, destination and item details when the shop processes an order for fulfilment.

Online withdrawal function

If you use the online withdrawal function and submit a declaration, we collect your name, contract or order reference, receipt email address, whether you withdraw all or part of the contract, and any item details you add. The server-side review preview is available for confirmation for ten minutes. After you confirm, we store the declaration, receipt time, language and email-delivery status in a private record. We email you an acknowledgement with the declaration and receipt time and notify the store administrator; failed notices may be retried. A short-lived counter derived from your IP address protects the form against abuse. We process these data to handle the withdrawal and fulfil legal acknowledgement and record duties (GDPR Article 6(1)(b) and (c)), and to protect the service and handle claims (Article 6(1)(f)). Confirmed declarations are retained while the withdrawal, refund or related claim is handled and for any applicable business-correspondence or record duty. The ten-minute preview limit is not an automatic deletion period for a confirmed declaration; erasure requests are assessed individually.

Stripe payments if offered

If Stripe is offered at checkout, we send Stripe the order amount and the billing, contact and transaction information needed to process your payment. If you enter card details, Stripe-hosted fields collect them directly; our shop does not store your full card number or security code. In that case, we retain the order and payment status and a Stripe transaction reference to administer the purchase and meet applicable record duties. The legal bases are performance of the purchase contract (GDPR Article 6(1)(b)) and legal record obligations (Article 6(1)(c)); an open payment dispute or fraud investigation may also involve our legitimate interests (Article 6(1)(f)).

If Stripe is used, it processes some payment information on our instructions and other information for its own fraud prevention and legal duties. Its payment components may receive device and network information and use browser identifiers or cookies for security. The actual technologies depend on the payment options enabled; see Stripe’s privacy notice and cookie policy. If information is transferred to Stripe, LLC in the United States, Stripe’s Data Transfers Addendum describes the EU–US Data Privacy Framework and, where applicable, EU Standard Contractual Clauses as transfer mechanisms.

Recipients and transfers

Hostinger provides the website hosting, active content-delivery network and shop email mailbox. The hosting plan lists the website server in Lithuania and backups in France; the content-delivery network, email and support functions may involve other locations. Hostinger’s necessary service providers may support infrastructure, security and email delivery. DHL Express Commerce receives details of orders sent for fulfilment as described above. Authorities receive data where the law requires it.

Hostinger’s data-processing addendum covers hosting and email. For transfers outside the European Economic Area to countries without an EU adequacy decision, it provides for EU Standard Contractual Clauses, where applicable. The clauses are available from the European Commission; you can also ask us about the safeguards for a relevant transfer.

How long information is kept

We use the following criteria rather than one period for every record:

• Technical request records are needed for delivery, troubleshooting and protection against misuse. A record connected to an incident or claim may be needed until that matter is resolved. The hosting provider also applies its operational log and backup cycles.
• Contact correspondence is needed until the enquiry is resolved. It may be kept longer where it forms part of business correspondence, an open dispute or a legal obligation.
• Cart and login data are needed while the corresponding session or account is in use.
• Order, invoice, refund and payment-reference records are needed to handle the transaction, returns and claims and to meet applicable commercial and tax record duties. The relevant duty or unresolved matter determines how long the corresponding records are needed.

We do not currently apply a fixed automatic cleanup period to order and account records. An erasure request is assessed against the remaining purpose, any statutory record duty and any open claim; data without a continuing basis should be erased or anonymised. Backup copies follow the provider’s backup cycle and may remain temporarily after deletion from the active store.

Your rights

Subject to the legal conditions, you may request access, correction, erasure, restriction or portability, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. Contact us using the details above. You may also complain to a data-protection supervisory authority.