Enjoy 15% off your first order with code ERA15
ERA BY NAZ Bag

Privacy Policy

This is a translation provided for your convenience. The German version of this document is the legally binding one. View the German version.

1. Controller

The controller for data processing on this website is:
ERA BY NAZ
Owner: Nazanin Fathi
Address: Füsilierstraße 8, 40476 Düsseldorf
Germany
E-mail: fathi@erabynaz.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. Hosting

This website is hosted by GoDaddy.com, LLC or its European group companies. The provider processes personal data arising from your visit to this website on our behalf (in particular server log files, see section 3). The legal basis is our legitimate interest in the secure and efficient provision of our offering under Art. 6(1)(f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. A transfer to the USA cannot be ruled out; it takes place on the basis of the European Commission’s standard contractual clauses.

3. Server log files

When this website is accessed, information is automatically stored in server log files: the page requested, date and time, volume of data transferred, referring URL, the browser used and its version, operating system and the IP address. This data is not merged with other sources. Processing takes place on the basis of Art. 6(1)(f) GDPR for the purpose of secure operation and fault analysis. The log files are deleted regularly, after 30 days at the latest.

4. Cookies

This website uses only technically necessary cookies. We do not use analytics, advertising or tracking cookies.

Language selection (erabynaz_lang): stores the language you have chosen. Lifetime 1 year. Currency selection (erabynaz_currency): stores the currency you have chosen. Lifetime 1 year. Basket and session (WooCommerce/WordPress): required for the basket, signing in and the ordering process. Lifetime, depending on the cookie, until the end of the session or up to 2 days.

The legal basis is § 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR, as these cookies are strictly necessary for the function you have expressly requested. No consent is required for this.

5. Fonts

Fonts are served from our own server. No connection is made to Google Fonts or any other external provider. Your IP address is not transmitted to third parties in this process.

6. Location detection for currency display

In order to show prices in the currency appropriate to your country, your IP address is matched against a database from the provider MaxMind, Inc. held locally on our own server. Only the country is determined. Your IP address is neither stored nor transmitted to MaxMind for this purpose. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in displaying prices correctly). You can change the currency yourself at any time using the currency selector.

7. Contact form and contact by e-mail

If you contact us via the contact form or by e-mail, we process your name, your e-mail address, the subject you selected and your message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR together with your consent under Art. 6(1)(a) GDPR, which you give by ticking the relevant box. Your details are not stored in a database but transmitted to us solely as an e-mail. We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations prevent this.

To prevent automated enquiries the form contains a field that is invisible to you (a honeypot). No personal data is collected by this means.

8. Newsletter and early registration

If you register for news about the first collection, we process your name and your e-mail address for that purpose alone. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by e-mail to us. The lawfulness of processing carried out before the withdrawal remains unaffected.

9. Customer account

For a customer account we process your first and last name, your e-mail address and your password. Passwords are stored exclusively as a cryptographic hash; we cannot read them in plain text. The legal basis is Art. 6(1)(b) GDPR. You may have your account deleted at any time.

10. Business customers and wholesale access

If you apply for a business account with wholesale access, we additionally process your company name, VAT identification number, country and website. These details serve to verify your business status and to release access to wholesale prices. The legal basis is Art. 6(1)(b) GDPR together with our legitimate interest in verifying trade status under Art. 6(1)(f) GDPR. We inform you of approval or refusal by e-mail. No automated decision-making within the meaning of Art. 22 GDPR takes place: every application is decided individually.

11. Orders and order requests

For an order or a wholesale order request we process the data required to perform it, in particular name, address, e-mail address and the items, sizes and quantities ordered. The legal basis is Art. 6(1)(b) GDPR. Retention periods under commercial and tax law of up to 10 years pursuant to § 147 AO and § 257 HGB remain unaffected; for the duration of those periods the data is restricted in processing.

12. Payment service providers

If you make a payment online, it is handled by Stripe Payments Europe, Ltd. Your payment data is transmitted directly to Stripe; we ourselves do not receive complete card or account details. The legal basis is Art. 6(1)(b) GDPR. A transfer to the USA takes place on the basis of the European Commission’s standard contractual clauses. Stripe’s own privacy information applies in addition.

No online payment takes place for wholesale order requests. Invoicing is handled separately.

13. Sending e-mail

For sending and receiving e-mail we use Microsoft 365 from Microsoft Ireland Operations Limited. Processing on our behalf and third-country transfers are governed by Microsoft’s contractual terms, including the standard contractual clauses.

14. Your rights

You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You may withdraw a consent you have given at any time with effect for the future.

Please contact fathi@erabynaz.com for this purpose.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority of the federal state in which you reside or in which we are established.

15. SSL/TLS encryption

For security reasons this website uses SSL or TLS encryption. You can recognise an encrypted connection by the address line of your browser beginning with “https://”.

16. Changes to this privacy policy

We will adapt this privacy policy as soon as the data processing on this website changes, for example when online payment is activated or further services are used.