Privacy policy – MOON DOG

This privacy policy describes which personal data is processed in the Moon Dog shop, for what purposes, and which rights you have.

1. Controller

MOON Dog GmbH
Maierhof 2
94167 Tettenweis
Germany
Email: info@moon-dog.de

Please send data protection requests to the address above or by email with the subject "Datenschutz".

2. General information on data processing

We process personal data only insofar as this is necessary to operate the shop, handle orders, communicate with you, comply with legal obligations or on the basis of your consent.

The legal bases are in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests).

3. Provision of the website and server log files

When you visit the shop, technically necessary data is processed so that the website can be delivered, operated reliably and protected against misuse. This may include the IP address, date and time of access, the URL requested, referrer, browser and device information and the amount of data transferred.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the shop securely, efficiently and with as few errors as possible.

4. Cookies and local storage

The shop uses technically necessary cookies, in particular for the cart and checkout. Without these cookies, the cart, delivery address, payment and order steps cannot be provided reliably.

On your first visit we ask you in a notice window whether you agree to statistics and marketing services. You can accept all of them, allow only the necessary ones or choose individually. We store your choice together with the date and the version of this policy in your browser (local storage and a cookie of our own), so that we do not have to ask you again on every visit. You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of every page. The legal basis for storing your choice is Section 25(2) No. 2 TDDDG and Art. 6(1)(c) GDPR.

Analytics and marketing services are only loaded if you have agreed. By default the shop sets Google Consent Mode to "denied". For browser storage related to the newsletter notice window, see Section 9.

5. Customer account, cart and order

When you add products to the cart or place an order, we process the data required to perform the contract. This includes in particular your name, email address, billing and delivery address, telephone number, cart and order data, payment and shipping information as well as records required under commercial and tax law.

The legal basis is Art. 6(1)(b) GDPR. Where statutory retention obligations apply, we also process the data on the basis of Art. 6(1)(c) GDPR.

6. Payment, shipping and communication service providers

Service providers may be used for payment, shipping and transactional emails. They only receive the data they need for their respective service. The available payment methods are shown at checkout; shipping and communication data is processed to handle orders, deliver them and keep you informed. If you pay in advance by bank transfer, we process the details from your transfer (in particular the account holder's name, IBAN, amount and payment reference) to match the payment to your order.

The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary to perform the contract. For records required by law, Art. 6(1)(c) GDPR applies.

For orders paid in advance by bank transfer, we additionally store the IP address of the ordering device for up to 48 hours to limit misuse of the ordering function; only a few orders are possible from one IP address within 24 hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing misuse. The IP address is then deleted automatically.

7. Google Tag Manager, Google Analytics 4 and Google Ads

With your consent to "Statistics" we load Google Tag Manager and Google Analytics 4. This helps us understand how visitors use the shop, for example which pages are visited and which products are viewed or added to the cart. We only transmit order-related events if your consent was recorded as given at checkout.

With your consent to "Marketing" we additionally use Google Ads conversion tracking. This lets us measure whether a visit via one of our ads led to an order or pre-order.

The provider in each case is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It cannot be ruled out that data is transferred to Google LLC in the USA. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR; you can withdraw it at any time with effect for the future via "Cookie settings".

7a. Meta Pixel

With your consent to "Marketing" we use the Meta Pixel. It records that you have visited our shop and carried out certain actions there, for example viewed or ordered a product. This allows us to measure the success of our ads on Facebook and Instagram and to show ads to people who have shown an interest in MOON Dog.

The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); Meta alone is responsible for any further processing. It cannot be ruled out that data is transferred to Meta Platforms, Inc. in the USA. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR; you can withdraw it at any time via "Cookie settings".

8. Pre-order and availability notifications

Using the sign-up form, you can register to receive information about the start of pre-orders or the availability of a product. Sign-up uses the double opt-in procedure: after you submit the form, we send you an email with a confirmation link. Your sign-up only becomes effective once you click this link; without confirmation we do not store your email address permanently.

The purpose of processing is to send you the notification you requested. The legal basis is your consent under Art. 6(1)(a) GDPR.

As proof of your consent, we process your email address, the selected product and type of sign-up, the consent text including its version, the time of sign-up and confirmation, and the IP addresses used in the process.

Unconfirmed sign-ups are deleted automatically and permanently once the confirmation link has expired plus a short grace period. We process confirmed sign-ups until you withdraw your consent or until the purpose of the notification has been fulfilled.

You can withdraw this consent at any time with effect for the future and request the deletion of your data. Send your withdrawal or deletion request informally to the address or email address given in Section 1; we will then delete your sign-up permanently.

With your consent, we send you our newsletter by email with news about products, offers and promotions from MOON Dog GmbH. To sign up we only need your email address; we take your language preference (German or English) from the language version of the website so that you receive the newsletter in your language. The legal basis is your consent under Art. 6(1)(a) GDPR.

Sign-up uses the double opt-in procedure: after you submit the form, we send you an email with a confirmation link. This email contains no advertising. We only add you to the newsletter list once you click the link.

As proof of your consent, we store your email address, the consent text including its version, the language, the times of sign-up, confirmation and any later unsubscription, and the IP addresses used in the process as transmitted to us by the shop. The legal basis for this evidence is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

To send the newsletter and manage the mailing list we use Mailjet, a service of Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France. Mailjet processes your email address and language preference on our behalf on servers in the European Union; we have concluded a data processing agreement with Mailjet pursuant to Art. 28 GDPR. Mailjet notifies us of unsubscriptions, spam complaints and permanently undeliverable addresses so that we can update your status.

You can withdraw your consent at any time with effect for the future, most easily via the unsubscribe link in every newsletter. Alternatively, an informal message to MOON Dog GmbH at the address or email address given in Section 1 is sufficient. After you unsubscribe, you will no longer receive the newsletter.

We automatically delete unconfirmed sign-ups 7 days after the last confirmation email, or after 30 days if no confirmation email could be sent. After an unsubscription, a spam complaint or permanent undeliverability, we keep the proof of your consent and unsubscription for 3 years after the last status change in order to be able to demonstrate that sending was lawful; after that we delete the data and remove your address from the Mailjet list. If you request the deletion of an address that is blocked because of a spam complaint or undeliverability before then, we only store a check value (hash) of the address for this period, created with a secret key. It cannot be converted back into the address and prevents the address from being added to the list again.

The newsletter sign-up may also be offered in a notice window that appears while you scroll. The fact that you have seen or closed this window is only stored in your browser for the duration of the session (session storage) so that it does not appear again. Only if you allow the category for functional services in the consent banner do we additionally remember that you closed it for 30 days in your browser's local storage. This information is not transmitted to us.

10. Recipients and data processing on our behalf

We use technical service providers for hosting, shop operation, maintenance, payment processing, shipping, email delivery, analytics and error diagnostics. We send transactional emails such as confirmation and order emails as well as the newsletter via Mailjet (Mailjet SAS, Paris, France; see Section 9). Where these service providers process personal data on our behalf, they do so on the basis of a data processing agreement pursuant to Art. 28 GDPR.

11. Storage period

Personal data is deleted or blocked as soon as the purpose of processing no longer applies and no statutory retention obligations prevent this. Commercial and tax records may generally be retained for six to ten years.

12. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interests and the right to withdraw consent you have given.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.