Privacy policy

Privacy Policy

We are pleased about your interest in our online shop. Protecting your personal data is important to us. Below we inform you about which data we process, for which purpose, on which legal basis and which rights you have.

Version of this policy: 18 August 2026

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Ipanema Beauty UG (haftungsbeschränkt)
Pappelallee 78/79
10437 Berlin
Germany

Telephone: 030 23326619
Email: support@try-vaya.com

Managing Directors: Amadeus Auracher, Nassim Eshaghi
Commercial register: Amtsgericht Charlottenburg, HRB 204013 B
VAT identification number: DE323613520

2. Access data and hosting

You can visit our web pages without providing any information about yourself. Each time a page is called up, the server automatically stores a so-called server log file containing the name of the requested file, your IP address, the date and time of the request, the volume of data transferred and the requesting provider.

We evaluate this access data solely in order to ensure trouble-free operation of the site and to improve our offering. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a correct and secure presentation of our offering. The access data is deleted no later than seven days after the end of your visit.

Our online shop is operated by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, as our processor. Shopify also processes data outside the European Union. Transfers to the Canadian parent company Shopify Inc. are based on the European Commission's adequacy decision for Canada. Intra-group transfers to other third countries take place on the basis of Shopify's Binding Corporate Rules, and otherwise on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Further information: https://www.shopify.com/legal/privacy

3. Data processing for contract performance and contact

We collect personal data when you voluntarily provide it to us in the course of your order or when you contact us. Mandatory fields are marked as such, because we absolutely need this data in order to perform the contract or to handle your enquiry. Which data is collected can be seen from the respective input forms.

The legal basis is Art. 6(1)(b) GDPR for the performance of the contract and for answering your enquiries. If you open a customer account, we additionally process your data on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

If you take out a subscription, we process your data for the recurring fulfilment and billing on the basis of Art. 6(1)(b) GDPR.

After the contract has been fully performed or your customer account has been deleted, we restrict the processing of your data and delete it once the retention periods under tax and commercial law have expired. Under § 147 Abgabenordnung (the German Fiscal Code) and § 257 Handelsgesetzbuch (the German Commercial Code) these periods are generally ten years.

4. Recipients of your data

We only pass on your data insofar as this is necessary for the purposes stated. Below we name the service providers that receive personal data about you in this context. Where a provider processes data outside the European Union, we state the basis for the transfer.

4.1 Shop, payment and invoicing

  • Shopify International Limited, Ireland, operation of the online shop, as well as Shopify Payments for card payments, Apple Pay and Google Pay.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxemburg, payment processing when PayPal is selected. In this respect PayPal acts as its own controller.
  • Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, processing of payments via Klarna and Swish. Mollie forwards the data required for the payment to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. In this respect Klarna acts as its own controller and carries out an identity and credit check for purchase on invoice and instalment purchase.
  • Airwallex (Netherlands) B.V., Netherlands, processing of card payments in our checkout.
  • easybill GmbH, Düsselstraße 21, 41564 Kaarst, Germany, creation and dispatch of invoices.
  • Our tax adviser and the tax authorities, insofar as required by law.

4.2 Shipping, fulfilment and subscriptions

  • Hive Technologies GmbH, Maulbeerstraße 7, 15834 Rangsdorf, Germany, warehousing, picking and dispatch of your order.
  • DHL (Deutsche Post AG / DHL Group), Germany, delivery of your order.
  • Supliful, Inc., USA, manufacture and dispatch of individual products. The transfer to the USA takes place on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
  • Loop Subscriptions, handling and administration of subscriptions.

4.3 Customer service and communication

  • Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, sending our emails and SMS messages and administering the associated recipient data. Klaviyo is certified under the EU-US Data Privacy Framework. The European Commission's Standard Contractual Clauses apply in addition. Details: https://www.klaviyo.com/legal/privacy-notice
  • Gorgias Inc., 768 Harrison Street, San Francisco, CA 94107, USA, handling of your support requests via email and chat. The transfer to the USA takes place on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

4.4 Reviews

  • Judge.me Limited, United Kingdom, collection and display of product reviews. An adequacy decision of the European Commission is in place for the United Kingdom.
  • Feedyio, Czech Republic, collection of customer feedback.

4.5 Analytics, advertising and shop functions

We only use the following services insofar as you have given your consent via our consent banner. Details under section 6.

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, web analytics and advertising.
  • Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, reach measurement and advertising.
  • Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Dublin 18, Ireland (Microsoft Clarity), analysis of page usage including the recording of mouse movements, clicks and scrolling behaviour in anonymised form.
  • AppLovin Corporation, USA, delivery and measurement of advertising. The transfer to the USA takes place on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
  • Triple Whale Inc., USA, evaluation of shop and marketing metrics.
  • BeProfit, evaluation of order and cost data.
  • Rokt (Aftersell), display of offers after the order has been completed.

Insofar as providers among the aforementioned services transfer data to the USA, this takes place on the basis of a certification under the EU-US Data Privacy Framework or on the basis of the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. We will provide you with copies of the Standard Contractual Clauses on request.

5. Email advertising

5.1 Newsletter with your consent

If you sign up for our newsletter, we use the data required for this or separately provided by you in order to send you our email newsletter regularly. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 7 Abs. 2 Nr. 2 UWG (the German Act Against Unfair Competition).

You can unsubscribe at any time and free of charge, via the unsubscribe link at the end of every promotional email or via the contact details given below.

5.2 Advertising to existing customers without separate consent

If you have placed an order with us, we additionally use your email address to send you advertising for our own similar goods, even if you have not separately signed up for the newsletter. The basis for this is § 7 Abs. 3 UWG (the German Act Against Unfair Competition, which permits direct advertising to existing customers) in conjunction with Art. 6(1)(f) GDPR, our legitimate interest in direct advertising to our customers.

You can object to this use at any time and free of charge, without incurring any costs other than the transmission costs according to the basic rates. Please use the unsubscribe link in every promotional email or write to support@try-vaya.com. Following your objection we will no longer use your email address for advertising.

5.3 Storage after the objection

If you object to the advertising or unsubscribe, we add your email address to an internal suppression list and store it there permanently. This is done solely for the purpose of implementing your objection permanently. Deleting the address completely would mean that we could inadvertently contact you again. The legal basis is Art. 6(1)(c) and (f) GDPR.

6. Cookies and similar technologies

We use cookies and comparable technologies on our website. Cookies are small text files that are stored on your device. Some are deleted at the end of the browser session, others remain on your device and make it possible to recognise your browser on your next visit.

We use technically necessary cookies, without which the shop does not work, on the basis of § 25 Abs. 2 Nr. 2 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, the German act on data protection in telecommunications and digital services). We use all other cookies and technologies, in particular for analytics and advertising, only with your consent pursuant to § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR.

You give your consent via our consent banner. You can withdraw it at any time with effect for the future by calling up the cookie settings on our website again and changing your selection. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

7. Profiling in the context of email marketing

On the basis of your order and interaction history, our email system calculates statistical forecasts, for example an expected date for a next order or an estimated churn probability. We use these values solely to control the sending times and content of our emails. This constitutes profiling within the meaning of Art. 4(4) GDPR. The legal basis is Art. 6(1)(f) GDPR.

No automated decision in an individual case producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place.

8. Social media

We maintain profiles on Facebook, Instagram, YouTube, Pinterest and LinkedIn in order to provide information about our products and to get in touch with customers. When you visit these profiles, your data may be collected by the respective platform operators for market research and advertising purposes and processed into usage profiles. The legal basis is Art. 6(1)(f) GDPR, unless you have given your consent to the platform operator; in that case Art. 6(1)(a) GDPR is the legal basis.

For our Facebook page there is a joint controllership agreement pursuant to Art. 26 GDPR: https://www.facebook.com/legal/terms/page_controller_addendum

9. Your rights

As a data subject you have the following rights against us:

  • Access pursuant to Art. 15 GDPR to the personal data we process, including a copy of that data.
  • Rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR.
  • Erasure pursuant to Art. 17 GDPR, insofar as the processing is not necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
  • Restriction of processing pursuant to Art. 18 GDPR.
  • Data portability pursuant to Art. 20 GDPR.
  • Withdrawal of consent given pursuant to Art. 7(3) GDPR with effect for the future.
  • Objection pursuant to Art. 21 GDPR.

Right to object

Insofar as we process personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation.

If we process your data for the purpose of direct marketing, you may object at any time and without giving reasons. Following your objection we will no longer process your data for this purpose.

Right to lodge a complaint

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, either with the authority of your place of residence, your place of work or our company's registered office. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
https://www.datenschutz-berlin.de

10. Contact for data protection matters

If you have questions about the processing of your personal data or about exercising your rights, please contact:

Ipanema Beauty UG (haftungsbeschränkt)
Pappelallee 78/79, 10437 Berlin
Email: support@try-vaya.com