1. Information on the collection of personal data and contact details of the data controller

1.1 In the following, we inform you about the handling of your personal data when using our website. Personal data is any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Büsra Bahadir
Schönaicher Straße 96
71032 Böblingen
Germany
Email: contact@lil-miracle.de

1.3 This website uses SSL/TLS encryption for security reasons and to protect the transmission of personal data. You can recognize an encrypted connection by the "https://" prefix and the padlock symbol in your browser's address bar.

2. Data collection when visiting our website

When you use our website for purely informational purposes, we only collect data that your browser transmits to our server (so-called server log files). When you access our website, we collect the following data, which is technically necessary to display the website to you:

• visited website
• Date and time of access
• Amount of data sent
• Source/referrer from which you accessed this page
• browser used
• Operating system used
• IP address used

The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the stability and functionality of our website.

3. Hosting and shop system (Shopify)

We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, Ireland.

Shopify provides the technical infrastructure for our online store. All data collected on our website is processed on Shopify's servers.

When using Shopify, data may also be transferred to Shopify's affiliated companies outside the European Union. In these cases, transfers are based on appropriate safeguards, in particular standard contractual clauses of the European Commission or adequacy decisions (e.g., the EU-US Data Privacy Framework).

For more information about data protection at Shopify, please visit:
https://www.shopify.com/legal/privacy

4. Consent Management and Cookies

This website uses the consent management platform "Consentmo" to obtain consent for the storage of certain cookies or the use of certain technologies and to document it in compliance with data protection regulations.

When you enter the website, you can use the cookie banner to decide which categories of cookies you want to allow.

We use:

Technically necessary cookies
These are required to provide basic website functions (e.g. shopping cart, login, checkout).

Analytics and marketing cookies
These will only be set if you have explicitly consented.

The legal basis for technically necessary cookies is Art. 6 para. 1 lit. f GDPR.
The legal basis for analysis and marketing cookies is Art. 6 para. 1 lit. a GDPR.

You can withdraw your consent at any time via the cookie settings.

5. Contact (contact form, email, WhatsApp)

When you contact us (e.g. via contact form or email), personal data will be collected.

This data will be used exclusively for the purpose of processing your request.

The legal basis is Art. 6 para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing inquiries).

WhatsApp chat

Our website includes a WhatsApp chat button (using the "EAZE WhatsApp Button" app). Clicking this button will redirect you to WhatsApp. Data such as your IP address and browser information may be transmitted to WhatsApp in the process.

Communication then takes place via the WhatsApp service.

For more information about data privacy at WhatsApp, please visit:
https://www.whatsapp.com/legal/privacy-policy-eea

6. Data processing for orders

To process your order, we process the following data:

• name
• Billing address
• Delivery address
• E-mail address
• Order data
• Payment information

The processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the performance of the contract.

After your order has been fully processed, your data will be stored in accordance with tax and commercial law retention periods.

7. Shipping service provider

The goods will be delivered by DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn).

For delivery purposes, we will pass on your name and delivery address to DHL.

The legal basis for this is Article 6(1)(b) GDPR.

8. Payment service providers

We work with the following payment providers to process payments:

PayPal
PayPal (Europe) S.à rl et Cie, SCA, Luxembourg

Shopify Payments
Payment processing is handled via Shopify Payments, technically provided by Stripe Payments Europe Ltd., Ireland.

Klarna
When selecting Klarna payment methods, payment processing is handled by Klarna Bank AB, Sweden.

Your data will only be passed on for the purpose of payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

9. Newsletters and email marketing

We use the Omnisend service to send our newsletter.

When you subscribe to our newsletter, we will use your email address exclusively for sending our newsletter.

Registration takes place via the double opt-in procedure.

The legal basis is Article 6 paragraph 1 letter a GDPR.

You can unsubscribe from the newsletter at any time via the unsubscribe link in the newsletter or by sending us a message.

Reminder emails for abandoned orders

If you enter your email address during the ordering process without completing the order, we may send you a reminder email about your shopping cart.

These emails are to remind you of an order you have started.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in completing orders that have already been started).

You can object to receiving such emails at any time.

10. Product Reviews

We use the Loox service to display and manage product reviews.

After a purchase, customers can be invited via email to leave a review.

Photos or videos can also be uploaded as part of the evaluation process.

If you submit a review with image or video content, this may be published on our website along with your first name or initials.

The legal basis is Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. f GDPR (legitimate interest in transparent customer reviews).

11. Google Tag Manager

This website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager is used to manage website tags via a single interface.

The service itself does not set cookies and does not process any personal data of users, but merely triggers other tags.

Further information can be found at:
https://policies.google.com/privacy

12. Online Marketing

Meta Pixels (Facebook / Instagram)

This website uses the Meta Pixel from Meta Platforms Ireland Ltd.

The meta pixel allows us to identify visitors to our website as a target audience for advertisements.

Processing only takes place with your consent in accordance with Art. 6 para. 1 lit. a GDPR.

TikTok Pixel

We use the TikTok Pixel from TikTok Technology Limited, Ireland.

The pixel allows us to measure the effectiveness of TikTok advertising campaigns and to target users in a more targeted way.

The processing will only take place with your consent in accordance with Art. 6 para. 1 lit. a GDPR.

13. Rights of the data subject

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 para. 3 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority.

14. Storage period of personal data

The duration of storage depends on the respective legal basis, the purpose of the processing and statutory retention periods.

Data processed for contract fulfillment will be stored in accordance with statutory retention periods.

Data processed on the basis of consent will be stored until the consent is withdrawn.

As of March 2026