Privacy Policy

for the glamsunlove.com online shop

Status: September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:

YBJ Fashion & Retail GmbH

Mühlerain 3

8706 Meilen

Switzerland

E-Mail: info@glamsunlove.ch

Website: glamsunlove.com

2. Representative in the European Union (Art. 27 GDPR)

Since YBJ Fashion & Retail GmbH is based outside the EU/EEA, processes personal data of individuals in the EU (including in the context of orders and through the use of analysis and marketing tools), and this processing is not merely occasional, the appointment of a representative in the Union is generally required under Art. 27 GDPR.

3. General information on data processing

3.1 Scope of processing of personal data

We generally process personal data of our users only to the extent necessary to provide a functional online shop, as well as our content and services. The processing of personal data regularly occurs only with the user's consent or, if obtaining consent is not possible and the processing is permitted by legal provisions, without separate consent.

3.2 Legal basis for processing

●      Art. 6 (1) lit. a GDPR: Processing based on given consent (e.g., cookies, newsletter, tracking tools).

●      Art. 6 (1) lit. b GDPR: Processing for the fulfillment of a contract or pre-contractual measures (e.g., order processing, customer account).

●      Art. 6 (1) lit. c GDPR: Processing for the fulfillment of a legal obligation (e.g., retention obligations under tax and commercial law).

●      Art. 6 (1) lit. f GDPR: Processing for the protection of legitimate interests (e.g., technically secure and stable operation of the online shop).

3.3 Data deletion and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also occur if provided for by legal requirements, in particular commercial or tax retention periods. If data is not blocked or deleted due to legal regulations, the data will be blocked, unless further storage is necessary for another legally provided purpose.

3.4 Recipients and data transfer to third countries

To provide the online shop and process orders, we use various service providers (processors), which are individually named in the following sections. We have data processing agreements with these service providers in accordance with Art. 28 GDPR. If service providers are based outside the EU/EEA (especially in the USA), data transfer takes place based on appropriate safeguards, in particular the EU standard contractual clauses of the European Commission, unless an adequacy decision exists.

4. Provision of the online shop (hosting via Shopify)

Our online shop glamsunlove.com is operated via the Shopware or e-commerce platform of Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (for users in the EU), parent company Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, Canada.

Each time our online shop is accessed, Shopify automatically collects information in so-called server log files, which the browser transmits, as part of its technical provision. This includes, in particular:

●      IP address of the accessing device

●      Date and time of access

●      Name and URL of the retrieved file

●      Website from which access is made (referrer URL)

●      Browser used and, if applicable, the operating system and the name of the access provider

Processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our legitimate interest in a technically error-free and secure operation of our online shop. A data processing agreement exists with Shopify; data transfers to Canada are based on the EU standard contractual clauses or an adequacy decision.

5. Cookies and consent management

Our online shop uses cookies. Cookies are small text files that are stored on the users' end device. We distinguish between technically necessary cookies and cookies that require prior consent.

5.1 Technically necessary cookies

These cookies are necessary for the online shop to function correctly, particularly features such as the shopping cart, order process, and session management. The legal basis is Art. 6 (1) lit. f GDPR or – where applicable – the corresponding national implementations of Art. 5 (3) of the ePrivacy Directive.

5.2 Cookies requiring consent (analytics and marketing)

Cookies that are not technically necessary – for example, for audience measurement (Google Analytics) or advertising purposes (Meta/Facebook Pixel) – are only used with the prior consent of users (Art. 6 (1) lit. a GDPR). When visiting our online shop for the first time, a cookie consent banner is displayed, through which users can give their consent, refuse it, or differentiate settings per category. Given consent can be revoked at any time with future effect, e.g., via the cookie settings in the banner or in the browser settings.

6. Contacting us

If you contact us by e-mail or via a contact form, the data you provide (e.g., name, e-mail address, content of the request) will be stored by us for the purpose of processing your request and for the event of follow-up questions. The legal basis is Art. 6 (1) lit. b GDPR, if the request is related to a contract, otherwise Art. 6 (1) lit. f GDPR due to our legitimate interest in answering inquiries. The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected.

7. Customer account

If users create a customer account in our online shop, we process the data provided (e.g., name, address, email address) for the purpose of managing the account and simplifying future orders. The legal basis is Art. 6 (1) lit. b GDPR. The customer account can be deleted at any time; the data will then be deleted unless legal retention obligations prevent this.

8. Order processing

In the context of an order, we collect and process the data necessary for contract fulfillment, in particular:

●      Name and address (billing and delivery address)

●      Email address and, if provided, telephone number

●      Order and payment data

The legal basis is Art. 6 (1) lit. b GDPR (fulfillment of contract) and Art. 6 (1) lit. c GDPR, insofar as we are obliged to retain this data for tax and commercial law reasons. For contract processing, we transmit data to the payment service providers and shipping service providers we use (see sections 9 and 10).

9. Payment service providers

9.1 PayPal

When paying via PayPal, the data required for payment processing (e.g., name, address, order amount) is transmitted to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The transmission is based on Art. 6 (1) lit. b GDPR (fulfillment of contract) and, where applicable, Art. 6 (1) lit. f GDPR. PayPal may in turn pass on the data to its own subcontractors and affiliated companies. Further details are governed by PayPal's privacy policy.

9.2 Credit card payment via Stripe

Credit card payments are processed via the payment service provider Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The data required for payment processing (including name, credit card details, order amount) is transmitted to Stripe. The legal basis is Art. 6 (1) lit. b GDPR. Further information can be found in Stripe's privacy policy.

10. Shipping

We work with an external logistics partner for the storage, picking, and packaging of ordered items. The provider is Güll GmbH, Heuriedweg 19, 88131 Lindau, Germany. In the course of order processing, we transmit the necessary data (including name and delivery address) to this company. The legal basis is Art. 6 (1) lit. b GDPR (fulfillment of contract). A data processing agreement exists with Güll GmbH in accordance with Art. 28 GDPR.

11. Google Analytics

We use the web analytics service Google Analytics, subject to your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that enable an analysis of your use of our online shop. The information generated by the cookie about your use of this online shop is usually transmitted to a Google server and stored there.

The use is exclusively based on your consent in accordance with Art. 6 (1) lit. a GDPR, which you can give via the cookie consent banner and revoke at any time with future effect. IP anonymization is activated on this website, so that Google truncates your IP address within member states of the EU or the EEA before transmitting it to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. A data processing agreement exists with Google.

12. Meta / Facebook Pixel

We use the "Meta Pixel" (formerly Facebook Pixel) of the social network Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"), on our online shop, subject to your consent. The Meta Pixel makes it possible to determine visitors to our online shop as a target group for the display of advertisements ("Facebook Ads") and to measure the success of advertising campaigns.

Processing is carried out on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR, which is obtained via the cookie consent banner and can be revoked at any time. It cannot be excluded that data may be transferred to the USA. Further information on data protection at Meta can be found in Meta's data policies.

13. Newsletter

If you subscribe to our newsletter, we will use the requested data (e-mail address, optional name) exclusively for sending the newsletter (double opt-in procedure). The subscription is based on your consent in accordance with Art. 6 (1) lit. a GDPR. You can revoke your consent at any time with future effect by unsubscribing via the unsubscribe link in each newsletter e-mail or by informing us via e-mail. The legality of the processing operations already carried out remains unaffected by the revocation.

14. Your rights as a data subject

You have the following rights concerning your personal data:

●      Right to information (Art. 15 GDPR)

●      Right to rectification (Art. 16 GDPR)

●      Right to erasure (Art. 17 GDPR)

●      Right to restriction of processing (Art. 18 GDPR)

●      Right to data portability (Art. 20 GDPR)

●      Right to object to processing (Art. 21 GDPR)

●      Right to withdraw consent with effect for the future (Art. 7 para. 3 GDPR)

To exercise these rights, you can contact us at any time using the contact details provided above in section 1.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).

16. Data security

During your website visit, we use the widespread TLS (Transport Layer Security) procedure in conjunction with the highest encryption level supported by your browser. Furthermore, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties.

17. Topicality and amendment of this privacy policy

This privacy policy is currently valid (as of: September 2026). Due to the further development of our online shop and the use of new technologies, it may become necessary to amend this privacy policy. We reserve the right to amend the privacy policy with effect for the future. The current version can always be found on this page.