Privacy policy
Privacy Policy
We're glad you're interested in Mizodia. Protecting your personal data matters to us. Below we inform you about what data we collect, what we use it for, and what rights you have.
1. Controller
The controller responsible for data processing on this website is:
Youvendo GmbH
Im Stöckacker 18
79224 Umkirch
Deutschland
Represented by: Ali Hosseinzadeh Fard Moghadam, Marc Begoug, Felix Streckfuss
Email: support@mizodia.com
VAT identification number: DE340943742
2. General information on data processing
Scope. As a general rule, we only process personal data to the extent necessary to provide a functioning website along with our content and services, or where you have given your consent.
Legal bases. Depending on the purpose, we base the processing on:
- Art. 6(1)(a) GDPR – your consent (e.g. newsletter, non-essential cookies)
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. order processing)
- Art. 6(1)(c) GDPR – legal obligation (e.g. retention obligations under commercial and tax law)
- Art. 6(1)(f) GDPR – our legitimate interests (e.g. security and stability of the shop, fraud prevention)
Erasure. We erase personal data as soon as the purpose of processing no longer applies. Data is retained for longer where statutory retention periods apply – in particular ten years under § 147 AO and § 257 HGB for invoices and accounting records, and six years for other business correspondence. Processing is restricted for the duration of these periods.
3. Provision of the website and server log files
Each time you access our website, data that your browser sends is automatically transmitted: IP address, date and time of access, the page accessed, the amount of data transferred, the referrer URL, browser type, and operating system.
This data is technically necessary to deliver the website, ensure its stability and security, and ward off attacks. The legal basis is Art. 6(1)(f) GDPR. The log data is processed by our hosting provider Shopify and is deleted or anonymized after a short time.
4. Cookies, consent management, and Pandectes
We use cookies and comparable technologies (e.g. local storage). Technically necessary cookies enable basic functions such as the cart, login, and language settings; they are set on the basis of § 25 Abs. 2 Nr. 2 TDDDG and Art. 6(1)(f) GDPR and do not require consent.
Non-essential cookies – for example for reach measurement, personalization, and advertising – are only set with your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR.
To obtain and manage your consent, we use the application Pandectes GDPR Compliance. It displays a consent banner the first time our shop is visited, blocks scripts that require consent until you make a decision, and documents your selection. For this purpose, a consent cookie is stored along with technical details such as the time of consent, the categories selected, a consent identifier, and a truncated IP address. This processing serves to document consent and is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
We have integrated Pandectes in IAB Transparency & Consent Framework (TCF) mode. Your selection is stored in a standardized format so that integrated providers can read it.
You can change or withdraw your consent at any time with effect for the future by reopening the consent banner via the cookie icon or the "Cookie settings" link. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
5. Shop platform Shopify
Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2. Etage, 1–2 Haddington Road, Dublin 4, D04 XN32, Irland. On our behalf, Shopify processes all data generated when the shop is visited and when an order is placed – in particular inventory, order, and usage data.
Shopify also collects usage data via its integrated analytics function for its own evaluation purposes and for our shop statistics. The legal basis is Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(f) GDPR for secure operation, and – insofar as non-essential cookies are set in the process – Art. 6(1)(a) GDPR.
We have a data processing agreement with Shopify under Art. 28 GDPR. Transfer to third countries, in particular to the USA and Canada, is possible and is safeguarded by the European Commission's standard contractual clauses.
6. Customer account
You can create a customer account. For this purpose, we process the data you provide (name, email address, address, and order data) to enable you to manage your orders. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time; statutory retention obligations remain unaffected.
7. Order processing
To process your order, we process inventory data (name, address, email address, phone number if applicable), contract data (items ordered, personalization details), and payment data. The legal basis is Art. 6(1)(b) GDPR, and for tax and commercial law archiving Art. 6(1)(c) GDPR.
We pass your data on to the recipients required to fulfill the contract: payment service providers, shipping service providers, and our tax advisor.
8. Payment service providers
Depending on the payment method chosen, your payment data is transmitted to the respective provider. We neither collect nor store complete card data. The legal basis is Art. 6(1)(b) GDPR.
- Shopify Payments – Shopify International Limited, Dublin, Irland; technical processing is carried out via Stripe.
- PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxemburg.
- Shop Pay, Apple Pay, and Google Pay – accelerated payment methods provided by Shopify, Apple Inc., and Google Ireland Limited respectively.
To prevent fraud and payment defaults, the payment service providers and Shopify carry out automated risk analyses and assign risk ratings in the process. Further details can be found under item 24.
9. Shipping service providers
To deliver your order, we transmit your name, delivery address, and – where required for shipment tracking – email address and phone number to:
- DHL and DHL Express – DHL Group / Deutsche Post AG, Bonn (Deutschland, Österreich, Schweiz)
- FedEx – FedEx Express Deutschland GmbH (übrige EU)
The legal basis is Art. 6(1)(b) GDPR. For shipments to Switzerland and other third countries, we transmit the information required for customs processing to the competent authorities (Art. 6(1)(c) GDPR).
10. Personalized products and uploaded templates
Our jewelry pieces are individually made. To do this, you can send us templates – such as fingerprints, hand and footprints, paw prints and nose prints, handwriting, drawings, photos, names, and dates.
We process this data exclusively to manufacture the product you ordered and to handle inquiries, complaints, and reorders. The legal basis is Art. 6(1)(b) GDPR. This data is only passed on to the service providers involved in production.
We do not process print and handwriting templates for the purpose of uniquely identifying a person. They are therefore not biometric data within the meaning of Art. 9(1) GDPR, but serve solely to realize the design of your jewelry piece.
Uploaded templates remain stored in association with your order. We keep them so that we can remake the same design for you in the event of a reorder and produce a replacement in the event of damage or loss, without you having to submit the template again. After the contract has been concluded, the legal basis for this is our legitimate interest in being able to permanently reproduce an individually designed piece of jewelry (Art. 6(1)(f) GDPR).
You can request deletion of your templates at any time. An informal message to support@mizodia.com is sufficient; we will then delete them, provided no statutory retention obligations conflict with this. You can likewise object to further storage under Art. 21 GDPR. The templates are deleted at the latest when the associated order data is deleted. Please note that after deletion, we can only carry out a reorder or replacement production if you provide us with the template again.
Your templates, photos, or engraving texts are not used for advertising or marketing purposes. Should we ever ask for your permission to show a design, we will obtain separate consent for this, which you can withdraw at any time.
11. Customer service
To handle inquiries, we use the helpdesk software Gorgias (Gorgias Inc., San Francisco, USA). We process the content of your inquiry, your contact details, and – in order to respond – your order history. The legal basis is Art. 6(1)(b) GDPR for inquiries relating to an order, and otherwise Art. 6(1)(f) GDPR in our interest in efficient customer support. A data processing agreement is in place; transfer to the USA is safeguarded by standard contractual clauses.
12. Newsletter and email marketing
To send our newsletter, we use Klaviyo (Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA). Sign-up takes place via the double opt-in procedure: after you register, you receive an email with a confirmation link. Only after that do we add you to the distribution list. We log the sign-up, confirmation, and IP address so that we can document proof of consent.
The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time, for example via the unsubscribe link at the end of every email. Klaviyo evaluates whether newsletters are opened and which links are clicked in order to personalize content; this evaluation is also based on your consent.
If, as an existing customer, you receive product recommendations relating to goods you have already purchased, we base this on § 7 Abs. 3 UWG in conjunction with Art. 6(1)(f) GDPR. You can object to this at any time.
Klaviyo is also integrated into our website and records your behavior there – such as products viewed and abandoned carts – so that we can send you relevant reminders and recommendations. This recording only takes place with your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR and is blocked by our consent management platform without your agreement.
A data processing agreement is in place with Klaviyo; transfer to the USA is safeguarded by standard contractual clauses.
13. Product reviews
To collect and display reviews, we use Okendo (Okendo Pty Ltd, Sydney, Australien). After a purchase, we may ask you by email for a review; the legal basis is § 7 Abs. 3 UWG in conjunction with Art. 6(1)(f) GDPR, or your consent under Art. 6(1)(a) GDPR. Published reviews appear with the name you provided; you can request deletion at any time.
14. Translation of shop content
For multilingual presentation, we use the application T Lab – AI Language Translate. The app processes shop content and the language you have selected. The legal basis is Art. 6(1)(f) GDPR in our interest in presenting our offering in an understandable way.
15. Reach measurement and advertising tracking – overview
We measure how our shop is used and how successful our advertising is. Technically, this is done via Shopify's web pixel function: the integrated services receive events such as page views, product views, cart actions, and purchases.
Where necessary for matching, customer data such as email address, name, phone number, and address may also be transmitted to these services in encrypted or unencrypted form. Transmission takes place both from your browser and server-side from Shopify.
We use all services described in items 16 to 22 exclusively with your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Without consent, they are blocked by our consent management platform. You can withdraw your consent at any time via the cookie settings.
Some of these services are flagged with Shopify for the purpose "sale of data" (sale of data). This refers to the disclosure of usage data to advertising partners, as defined in particular by US privacy laws. This disclosure, too, only takes place with your consent.
16. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Google Analytics uses cookies and comparable technologies to evaluate your behavior on our website – such as pages accessed, time spent, origin of access, device used, and purchases made. This allows us to measure how our shop is used and to improve it.
Collection takes place exclusively with your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Without consent, the service is blocked by our consent management platform. In Google Analytics 4, IP addresses are shortened before any storage; complete IP addresses are not stored.
Google also processes the data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that the transfer is based on the European Commission's adequacy decision under Art. 45 GDPR; standard contractual clauses apply in addition. A data processing agreement is in place with Google.
Further information: policies.google.com/privacy
17. Google Ads and conversion measurement
We run advertising via Google Ads (Google Ireland Limited). Through conversion tracking, we measure whether a visit via one of our ads led to a purchase. In the process, a cookie is set when an ad is clicked, which expires after a certain period. We only receive aggregated statistics from Google and cannot use them to identify individual users.
This use, too, only takes place with your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. We use Google's consent mode (Consent Mode): without your agreement, no advertising cookies are set and signals transmitted to Google do not contain any personal identifiers.
Via the sales channel „Google & YouTube", we also transmit our product data to Google so that our items can be displayed there. No personal data about you is transmitted in the process.
18. Meta (Facebook and Instagram)
We use advertising and analytics services provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland. Via the Meta pixel and the supplementary server-side transmission (Conversions API), Meta receives information about your interactions in our shop – such as product views, cart actions, and completed purchases – as well as contact data in encrypted form for matching purposes.
Meta uses this data to measure the delivery of our ads, build target audiences, and show you personalized advertising on Facebook and Instagram. We are jointly responsible with Meta for the collection and transmission of the data within the meaning of Art. 26 GDPR; you can find the agreement concluded for this purpose at facebook.com/legal/controller_addendum. Meta alone is responsible for its subsequent processing of the data.
The legal basis is your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information: facebook.com/privacy/policy
In addition, we transmit our product catalog to Meta via the sales channel so that our items can be displayed there. A tag confirming our domain ownership is also embedded in the page source code; on its own, this does not transmit any user data.
19. TikTok
We use advertising and analytics services provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Irland. Via the TikTok pixel and the supplementary server-side transmission (Events API), TikTok receives information about your interactions in our shop as well as contact data in encrypted form for matching purposes. TikTok uses this data to measure and optimize our advertising and to build target audiences.
The legal basis is your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Transfer to third countries, including the USA, Singapore, and Malaysia, is possible and is safeguarded by standard contractual clauses. Further information: tiktok.com/legal/privacy-policy-eea
We also transmit our product catalog to TikTok via the sales channel.
20. Pinterest
We use advertising and analytics services provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Irland. Via the Pinterest tag and the supplementary server-side transmission (Conversions API), Pinterest receives information about your interactions in our shop as well as contact data in encrypted form for matching purposes, in order to measure the effectiveness of our ads.
The legal basis is your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Transfer to the USA is possible and is safeguarded by standard contractual clauses or the EU-U.S. Data Privacy Framework. Further information: policy.pinterest.com/de/privacy-policy
We also transmit our product catalog to Pinterest via the sales channel.
21. Elevar
To technically consolidate our tracking events, we use Elevar (Elevar Inc., USA). Elevar collects the events described above in our shop and forwards them – partly directly from the browser, partly server-side – to the analytics and advertising services we use. In doing so, usage data and, where necessary for matching, contact data in encrypted form are processed.
The legal basis is your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. A data processing agreement is in place; transfer to the USA is safeguarded by standard contractual clauses.
22. Affiliate marketing via Adcell
We work with the affiliate network ADCELL (Firstlead GmbH, Rosenfelder Straße 15–16, 10315 Berlin). If you reach us via a partner's link, a cookie is set that makes the referral traceable so that we can pay the partner the agreed commission. The partner ID, the time of the click, and, in the event of an order, the order value and order number are processed – no names or addresses.
The legal basis is your consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. Further information: adcell.de/datenschutz
23. Social media profiles
We operate profiles on Facebook, Instagram, TikTok, and Pinterest. The links in our shop are simple links – no data is transmitted to the platforms as long as you do not click them. If you visit our profiles, the respective provider's privacy policy applies; we have no influence over the processing that takes place there.
24. Automated fraud prevention
Shopify and our payment service providers automatically analyze orders for signs of fraud and assign a risk classification in the process. Among other things, details about the order, the payment method, the IP address, and the device used are evaluated. The legal basis is Art. 6(1)(f) GDPR in our interest in avoiding payment defaults and fraudulent orders.
This does not involve a decision that is exclusively automated with a legal effect or similarly significant impact within the meaning of Art. 22(1) GDPR: we always decide ourselves whether to accept or reject an order. If you disagree with a classification, please contact support@mizodia.com – we will then review the case manually.
25. Recipients and transfer to third countries
Recipients of your data are the service providers named in this policy, who act as processors on our behalf under Art. 28 GDPR, as well as authorities, insofar as we are legally obliged to provide information.
Some providers process data outside the European Union, in particular in the USA, Canada, and Australia. In these cases, we base the transfer on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, supplemented by additional safeguards, or – insofar as the provider is certified – on the adequacy decision on the EU-U.S. Data Privacy Framework under Art. 45 GDPR.
We point out that a level of data protection fully comparable to that in the European Union cannot be guaranteed in third countries, and in particular that access by local authorities cannot be ruled out.
26. Your rights
You have the following rights against us regarding your personal data:
- Information about the data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Insofar as we process data on the basis of legitimate interests, you can object to the processing for reasons arising from your particular situation. You can object to processing for the purposes of direct marketing at any time and without giving reasons.
A message to support@mizodia.com is sufficient to exercise your rights.
27. Right to lodge a complaint with the supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de
28. Necessity of providing data
Providing your data is neither legally nor contractually required. However, without the details required for order processing, we cannot conclude or perform a contract with you.
29. Changes to this privacy policy
We adapt this privacy policy whenever changes to our services or the legal situation require it. The version available at the time of your visit shall apply.
Last updated: 31 July 2026