Privacy policy

1. Controller

The controller responsible for the processing of personal data on this website and in connection with our online shop is:

Gubaidullina Asiia
mercy + the Devils
Email: owlpost@mercyandthedevils.com

2. General Information on Data Processing

We process personal data only where this is necessary to provide our website, process orders, communicate with you, process payments, comply with legal obligations, or for the purposes described in this Privacy Policy.

Personal data means any information relating to an identified or identifiable individual.

3. Legal Bases for Processing

Unless otherwise stated in this Privacy Policy, we process personal data on the following legal bases:

Article 6(1)(b) GDPR – where processing is necessary for the performance of a contract with you or for taking steps at your request prior to entering into a contract;
Article 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation;
Article 6(1)(f) GDPR – where processing is necessary for our legitimate interests and those interests are not overridden by your interests or fundamental rights and freedoms;
Article 6(1)(a) GDPR – where we have obtained your consent for a specific processing purpose.

4. Hosting and Operation of the Online Shop

Our online shop is operated using Shopify. Shopify provides the technical infrastructure for our online shop, including the website, shopping cart, checkout and other shop functions.

When you use our shop, information such as your IP address, device and browser information, technical access data and information you provide when placing an order or contacting us may be processed.

This processing is carried out in particular to provide and secure our online shop, process orders and fulfil our contractual and legal obligations.

Shopify may process personal data in its capacity as a processor or, for certain of its own purposes and services, as an independent controller. Further information is available in Shopify's Privacy Policy.

5. Orders and Contract Processing

When you place an order through our online shop, we process the data required to fulfil the contract. This may include your name, billing and delivery address, email address, telephone number, order details and other information you provide during the ordering process.

We use this information to process and fulfil your order, communicate with you, deliver the goods, process returns and withdrawals, and comply with statutory record-keeping and documentation obligations.

The legal bases are Articles 6(1)(b) and 6(1)(c) GDPR.

6. Payment Service Providers

We use the payment service providers and payment methods offered during the checkout process.

6.1 Shopify Payments

We use Shopify Payments to process credit and debit card payments. Payment and transaction data may be processed as part of the payment process.

This processing is necessary to process the payment and perform the contract under Article 6(1)(b) GDPR and, where applicable, to comply with legal obligations under Article 6(1)(c) GDPR.

6.2 PayPal

If you choose PayPal as your payment method, the information required to process the payment is transmitted to PayPal. This may include your name, email address, billing and delivery address, order information and payment information.

PayPal processes personal data in accordance with its own privacy policy. Further information is available in PayPal's Privacy Policy.

6.3 Apple Pay and Google Pay

If you use Apple Pay or Google Pay, the data required to process the payment is processed by the respective payment service in accordance with the payment method selected.

The processing is necessary to process the payment and perform the contract under Article 6(1)(b) GDPR. Apple's or Google's respective privacy policies also apply to processing carried out by those providers.

7. Production and Delivery of Ordered Products

We use Gelato as a service provider for the production and fulfilment of our print-on-demand products.

To produce and fulfil your order, the necessary order and delivery information may be transmitted to Gelato and/or the production and shipping partners involved in fulfilling the respective order. This may include your name, delivery address, email address, order information and, where applicable, telephone number.

This transmission is necessary for the performance of the purchase contract under Article 6(1)(b) GDPR.

Further information about data processing by Gelato is available in Gelato's Privacy Policy.

8. Contacting Us

If you contact us by email, we process the information you provide, in particular your email address, name and the content of your message, to the extent necessary to handle your enquiry.

Depending on the nature of the enquiry, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.

9. Newsletter and Email Marketing

We use Shopify Email and/or Shopify Messaging to send newsletters and marketing emails.

If you subscribe to our newsletter, we process your email address and any additional information you voluntarily provide in order to send you newsletters and information about our shop, products, promotions and news.

Newsletter subscriptions are generally based on your consent. Where a double opt-in procedure is used, you will receive a confirmation email after subscribing and must confirm your subscription.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link included in our newsletters. The lawfulness of processing carried out before withdrawal remains unaffected.

The legal basis is Article 6(1)(a) GDPR.

As part of email marketing, Shopify may process information about the delivery of marketing emails and interactions with them, such as whether an email was opened or an element was clicked, where this is configured and legally permitted.

10. Cookies and Similar Technologies

Our online shop uses cookies and similar technologies.

Technically necessary cookies and similar technologies are used where required for the operation of the shop, shopping cart, checkout, security or other functions expressly requested by you.

For non-essential cookies and similar technologies, we obtain your consent through Shopify's integrated Customer Privacy / Cookie Banner where consent is legally required before such technologies are used.

You can manage your consent through the relevant privacy settings and, where provided, change or withdraw it at any time.

11. Shopify Analytics

We use Shopify's integrated analytics functions to analyse the use of our online shop and improve our shop.

This may involve processing information about visits, devices, browsers, page views, products and interactions with the shop.

Where consent is required for the relevant processing, processing takes place only after you have provided the corresponding consent through the Shopify Cookie Banner.

12. Google Analytics

We intend to use Google Analytics to analyse the use of our online shop. Google Analytics will only be activated once the relevant technical integration has been implemented.

Where Google Analytics is activated and consent is required, processing will only take place after you have provided the corresponding consent through the Cookie Banner.

Google may process information about your use of our website, device and browser information, IP-related information and interactions with our website.

Further information about processing by Google and your privacy options is available in Google's privacy information.

13. Marketing and Advertising Pixels

We intend to use marketing and analytics functions provided by Meta, TikTok and Pinterest in the future. These services will only be activated once the relevant technical integration has been implemented.

Depending on the service, information about visits, interactions, devices and use of our online shop may be processed in order to measure advertising reach or analyse advertising campaigns.

Where consent is legally required for these technologies, they will only be activated after you have provided the corresponding consent through the Cookie Banner.

The respective providers' privacy information also applies to their processing of personal data.

14. Social Media and Third-Party Content

Where our website contains links to external websites or services, the privacy policies of the respective providers apply to processing carried out on those external websites.

Simply clicking an external link does not generally result in us transmitting personal data to the respective provider unless a third party has been technically integrated into our website.

15. Recipients of Personal Data

Depending on the purpose, personal data may be transmitted to the following categories of recipients:

Shopify and service providers connected with Shopify;
payment service providers, in particular Shopify Payments and PayPal;
payment services such as Apple Pay and Google Pay where used by you;
Gelato and the production and shipping partners involved in fulfilling the relevant order;
email and marketing service providers, in particular Shopify Email and/or Shopify Messaging;
analytics and marketing providers where these have been implemented and activated by us;
authorities, courts, tax advisers or other parties where required by law or necessary to protect or enforce our legal rights.

16. Transfers to Third Countries

Some of the service providers we use may process personal data outside the European Union or European Economic Area.

Where personal data is transferred to a third country, such transfers are carried out in accordance with the applicable requirements of Articles 44 et seq. GDPR. Depending on the service provider, this may include an adequacy decision of the European Commission, appropriate safeguards such as Standard Contractual Clauses, or another legally permitted transfer mechanism.

The respective providers may provide further information about international data transfers in their own privacy policies.

17. Retention Periods

We generally retain personal data only for as long as necessary for the relevant purposes.

We may also be legally required to retain certain information for specific periods, in particular under commercial and tax laws. Once these periods have expired, the relevant data will be deleted unless another legal basis for retention applies.

18. Your Rights

Subject to the applicable legal requirements, you have the following rights in particular:

the right to access your personal data under Article 15 GDPR;
the right to rectification under Article 16 GDPR;
the right to erasure under Article 17 GDPR;
the right to restriction of processing under Article 18 GDPR;
the right to data portability under Article 20 GDPR;
the right to object to certain processing under Article 21 GDPR;
the right to withdraw consent at any time with effect for the future.

To exercise your rights, you can contact us at owlpost@mercyandthedevils.com.

19. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

You may, in particular, contact the data protection supervisory authority responsible for our place of establishment.

20. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.