Privacy Policy

MHSA Gaedeke GmbH

The contract language is German. The German version of this Privacy Policy is the legally binding version. The English version is provided for information purposes only. In the event of any discrepancy or inconsistency between the German and English versions, the German version shall prevail.

This Privacy Policy explains which personal data we process when you visit our website and online shop at ms-sucra.de, place an order with us, visit or purchase from our physical store, or otherwise interact with us.

1. Data Protection at a Glance

General Information

Personal data is any information that can be used to identify you personally or that can be associated with you.

Depending on how you use our website, online shop or physical store, we process in particular the following categories of personal data:

• Identification and contact data such as name, address, email address and telephone number
• Order, contract and transaction data
• Payment and billing information
• Customer account and login data
• Shipping, return, cancellation and withdrawal data
• Communication data
• Cash register, POS and transaction data
• Device, browser, usage and connection data
• Cookie, analytics and marketing data where you have given your consent

We process this data in particular in order to:

• provide our website and online shop,
• process orders and payments,
• handle deliveries, returns, cancellations and withdrawals,
• provide customer accounts and self-service functions,
• communicate with you,
• process sales in our physical store,
• comply with statutory cash register, tax, accounting, recording and documentation obligations,
• ensure the security and proper functioning of our services, and
• carry out reach measurement, analytics and marketing activities where you have given your consent.

2. Controller

The controller responsible for the processing of personal data is:

MHSA Gaedeke GmbH
represented by the Managing Directors Marietta Gädeke and Hasan Eisso
Kapuzinerstraße 7–9
55116 Mainz
Germany

Phone: +49 176 64136917
Email: mg@ms-sucra.de

Our physical store is located at Weißliliengasse 19, 55116 Mainz, Germany. Where personal data is processed in connection with a visit to or purchase from our store, MHSA Gaedeke GmbH is also the controller responsible for that processing.

3. Hosting and Shop System

ALL-INKL

Our domain and parts of our business email infrastructure are provided by ALL-INKL.COM – Neue Medien Münnich.

Provider:
ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

In this context, IP addresses, technical connection data and server log data may in particular be processed.

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of our technical infrastructure.

Shopify

Our online shop is provided through Shopify. Shopify provides, among other things, product pages, shopping cart functions, checkout, customer accounts, order management, shop policies and other shop functions.

Provider for merchants in the European Economic Area:
Shopify International Ltd.
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Where necessary, data may also be processed by affiliated Shopify companies, in particular Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada.

In connection with Shopify, contact, account, order, transaction, payment, communication and technical usage data may in particular be processed.

The processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as it is necessary for taking steps prior to entering into a contract or for the performance of a contract. Otherwise, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in operating a functional and user-friendly online shop.

4. Legal Bases for Processing

We process personal data only where there is a legal basis for doing so.

Art. 6(1)(a) GDPR – Consent:
This legal basis applies in particular to certain cookies, tracking, analytics, newsletter and marketing activities.

Art. 6(1)(b) GDPR – Contract and pre-contractual measures:
This legal basis applies in particular to orders, payments, shipping, customer accounts, returns, cancellations, withdrawals and contract-related communication.

Art. 6(1)(c) GDPR – Legal obligation:
This legal basis applies in particular to tax, commercial, accounting and cash register documentation and retention obligations as well as legally required functions and records.

Art. 6(1)(f) GDPR – Legitimate interests:
This legal basis applies in particular to IT security, technical provision of our services, efficient business processes, general customer communication and the establishment, exercise or defence of legal claims.

5. Storage Period

We generally store personal data only for as long as necessary for the respective purpose.

Where statutory retention or documentation obligations apply, the relevant data will be retained for the respective legally required period.

Under Section 147 of the German Fiscal Code (AO), different retention periods apply depending on the type of document. Certain books and records must, for example, be retained for ten years, accounting documents for eight years and other tax-relevant documents for six years.

Data relating to contracts, orders, payments, returns, withdrawals or warranty matters may also be stored for as long as necessary to process the matter or to establish, exercise or defend legal claims.

6. Your Rights

Subject to the applicable statutory requirements, you have in particular the following rights:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to withdraw any consent you have given at any time with effect for the future
• Right to lodge a complaint with a data protection supervisory authority

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

7. SSL or TLS Encryption

Our website uses SSL or TLS encryption to protect the transmission of confidential information.

You can recognise an encrypted connection in particular by the use of “https://” in the address bar of your browser.

8. Cookies and Consent Management

Our website uses cookies and comparable technologies.

Technically necessary technologies are used where they are required for the operation and security of the website, shopping cart, checkout, language settings or other essential shop functions.

Access to information on your terminal device or the storage of information on your device in connection with technically necessary technologies is carried out in accordance with Section 25(2) TDDDG. Subsequent processing of personal data is carried out in particular on the basis of Art. 6(1)(f) GDPR or, where necessary for the performance of a contract, Art. 6(1)(b) GDPR.

Non-essential cookies and technologies for analytics, tracking or marketing purposes are generally used only with your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

We use Shopify's privacy and consent functions to manage and document your consent choices.

You can change or withdraw your consent choices at any time using our consent tool.

9. Server Log Files

When you visit our website, technical information may automatically be processed, including in particular:

• IP address
• Browser type and browser version
• Operating system
• Referrer URL
• Date and time of access
• Hostname or technical device information

The processing is carried out for the purpose of providing, maintaining the stability of and securing our website on the basis of Art. 6(1)(f) GDPR.

10. Contacting Us

If you contact us via contact form, email, telephone or WhatsApp, we process the information you provide in order to handle your inquiry.

This may include in particular your name, email address, telephone number, the content of your message and technical communication data.

The processing is carried out on the basis of Art. 6(1)(b) GDPR where your inquiry relates to a contract or a potential order. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR.

WhatsApp

If you communicate with us via WhatsApp, personal data may also be processed by WhatsApp or companies of the Meta group.

Provider:
WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

Use of WhatsApp is voluntary. You can alternatively contact us at any time by email or telephone.

11. Customer Account

You can use a customer account in our shop. For this purpose, we use Shopify's customer account functions.

Depending on how you use the account, your name, email address, addresses, order history, account settings and information relating to your orders may in particular be processed.

The customer account allows you to view orders and use certain self-service functions.

The processing is carried out on the basis of Art. 6(1)(b) GDPR.

Orders can generally also be placed without creating a permanent customer account.

12. Orders, Shipping, Returns and Withdrawal

When you place an order with us, we process in particular:

• Name
• Billing and shipping address
• Email address
• Telephone number, where provided
• Order number
• Products ordered
• Order and shipping information
• Payment and transaction information
• Discount or voucher information, where applicable
• Communication relating to your order

The processing is carried out for the purpose of processing and fulfilling your order on the basis of Art. 6(1)(b) GDPR.

Shipping

For shipping, we use in particular DHL and, where appropriate, other suitable shipping providers.

Where necessary for delivery, we transmit your name, shipping address and, where required, other necessary contact details to the respective shipping provider.

The legal basis is Art. 6(1)(b) GDPR.

Returns, Exchanges and Cancellations

If you request a return, exchange or cancellation, we process the order, contact, product and communication data necessary for handling the request.

The processing is carried out in particular on the basis of Art. 6(1)(b) GDPR.

Electronic Withdrawal Function

We provide an electronic function in our online shop for exercising the statutory right of withdrawal.

The function is accessible through the “Withdraw from contract” link in the footer of our website.

In connection with electronically exercising your right of withdrawal, we process in particular:

• your name,
• information identifying your order or the relevant contract,
• your email address or information relating to the electronic means of communication through which you wish to receive confirmation of receipt,
• the content of your withdrawal declaration,
• the date and time at which it was received, and
• where applicable, technical log and verification data.

The data is processed in order to receive your withdrawal declaration, assign it to the relevant order, process the reversal of the contract and provide the legally required electronic confirmation of receipt.

The processing is carried out on the basis of Art. 6(1)(b) GDPR for the processing of the contractual relationship and on the basis of Art. 6(1)(c) GDPR in connection with the statutory requirements governing the electronic withdrawal function.

The electronic withdrawal function is technically processed within our Shopify infrastructure.

Data generated in connection with a withdrawal is stored in accordance with the statutory retention periods applicable to contractual and business documentation or for as long as necessary to process the withdrawal or establish, exercise or defend legal claims.

13. Payment Services

We use external payment service providers to process payments.

Depending on the payment method selected, your name, billing address, order amount, payment method, order number, transaction data, IP address and technical device information may in particular be processed.

The processing is generally carried out on the basis of Art. 6(1)(b) GDPR.

Shopify Payments

We use Shopify Payments in particular for card payments, wallets and other payment methods offered during checkout.

Provider:
Shopify International Ltd.
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

PayPal

We also offer payment via PayPal.

Provider:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

In connection with payment processing, PayPal may process identity, contact, order, payment and risk-related data.

Fraud Prevention and Risk Assessment

Payment service providers may also process transaction, device, IP and risk-related data for authentication, fraud prevention and the prevention of payment defaults.

14. Newsletter and Email Communication

For newsletters and marketing emails, we use in particular Shopify Email.

Newsletter Subscription

If you subscribe to our newsletter, we process in particular your email address and, where applicable, your first and last name.

Registration generally takes place using a double opt-in procedure.

For documentation purposes, the time of registration and confirmation as well as related technical data may be processed.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link contained in our emails.

Newsletter Analytics

Where you have given your consent, we may analyse opens, clicks and comparable interactions with our marketing emails in order to improve our communication.

The legal basis is Art. 6(1)(a) GDPR.

Transactional Emails

Independently of any newsletter consent, we send emails where necessary for the performance of a contract or handling of your inquiry, for example order and shipping confirmations, information concerning returns, withdrawals or customer accounts.

The legal basis is Art. 6(1)(b) GDPR or, where a legally required notification is concerned, Art. 6(1)(c) GDPR.

15. Accounting – BuchhaltungsButler

We use BuchhaltungsButler for our accounting processes.

Provider:
BuchhaltungsButler GmbH
An der Schillingbrücke 4
10243 Berlin
Germany

In this context, billing, order, payment, customer and transaction data may in particular be processed.

The processing serves accounting purposes, payment reconciliation and compliance with statutory tax and commercial obligations.

The legal basis is Art. 6(1)(c) GDPR and, where additionally required, Art. 6(1)(f) GDPR due to our legitimate interest in efficient and proper accounting.

16. Communication Functions within Shopify

We use communication and service functions within Shopify to handle customer inquiries and organise our customer communication.

This may involve the processing of names, email addresses, telephone numbers, communication content and technical usage data.

The legal basis is Art. 6(1)(b) GDPR for contract-related communication and otherwise Art. 6(1)(f) GDPR.

17. Sales Channels and Platform Integrations

We connect our Shopify shop to various sales, product and marketing platforms.

These include in particular:

• Facebook and Instagram / Meta
• TikTok
• Pinterest
• Shop by Shopify
• Google & YouTube

Depending on the integration, product and shop information as well as – where necessary for the respective function – contact, order, device, usage, marketing and interaction data may be processed.

Where processing is necessary for the performance of a contract, it is carried out on the basis of Art. 6(1)(b) GDPR.

Where tracking, analytics or marketing technologies are used that require consent, processing is carried out only on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Other technically or organisationally necessary processing may be carried out on the basis of Art. 6(1)(f) GDPR.

18. Physical Retail, Shopify POS and Fiscalisation

Shopify Point of Sale

In our physical store, we use Shopify Point of Sale (POS) to process and manage sales and connect our physical and digital sales channels.

In this context, order, payment, return, discount, cash register and, where applicable, customer contact data may in particular be processed.

The processing is carried out on the basis of Art. 6(1)(b) GDPR where it is necessary for carrying out a purchase and on the basis of Art. 6(1)(c) GDPR where statutory cash register, accounting and recording obligations apply.

OpenFiskal – TSE and Cash Register Compliance

To comply with the statutory requirements applicable to electronic cash register systems and their technical security system (Technische Sicherheitseinrichtung – TSE), we use OpenFiskal.

Provider:
OpenFiskal GmbH
Rosenthaler Straße 72A
10119 Berlin
Germany
Email: help@openfiskal.com

OpenFiskal is used in connection with our Shopify POS system in order to record cash register transactions in accordance with statutory requirements, sign them using a TSE, retain the relevant records and make them available for tax audits and statutory verification purposes.

In connection with its use, the following data may in particular be processed:

• Cash register and transaction data
• Date, time and amount of a transaction
• Payment and receipt data
• Order and return information
• Cash register and location information
• TSE and signature data
• Technical device and session data
• Where applicable, customer and contact data insofar as such data forms part of a transaction processed through the POS system

The processing serves in particular to comply with statutory requirements for electronic recording systems, ensure the integrity and traceability of cash register transactions and provide data required for cash register inspections, tax audits and other tax-related verification obligations.

The legal basis is in particular Art. 6(1)(c) GDPR in conjunction with the applicable tax-related recording, cash register and retention obligations, including Sections 146, 146a and 147 of the German Fiscal Code (AO) and the applicable provisions of the German Cash Register Security Ordinance (KassenSichV). Where the processing is also directly necessary for performing a purchase contract, Art. 6(1)(b) GDPR additionally applies.

Where OpenFiskal processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Tax-relevant records are stored in accordance with the applicable statutory retention requirements.

Meldefluss – Notification of Electronic Cash Register Systems

For the legally required notification of our electronic recording systems and technical security systems to the German tax authorities, we also use the Meldefluss application provided by OpenFiskal GmbH.

Meldefluss can be connected to Shopify and OpenFiskal in order to identify our cash register systems and locations and compile the information required for the statutory cash register notification.

The following cash register and business-related information may in particular be processed:

• Company and location information
• Tax and reporting information
• Type and number of electronic cash register systems used
• Cash register and TSE serial numbers
• Commissioning and, where applicable, decommissioning dates
• Technical device and system information
• Where technically required for allocation purposes, data from the Shopify POS and order environment

Depending on the functionality we use, the reporting information may be transmitted electronically to the competent tax authorities or made available in files suitable for the statutory notification.

The processing is carried out on the basis of Art. 6(1)(c) GDPR in conjunction with Section 146a(4) of the German Fiscal Code (AO).

Where OpenFiskal GmbH acts as a processor on our behalf in this context, the processing is carried out on the basis of Art. 28 GDPR.

19. Google Services

We use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

These may include in particular Google & YouTube, Google Analytics 4 and Google Ads / Conversion Tracking.

Google & YouTube

We may synchronise product and shop information with Google Merchant Center and other Google services in order to display our products on Google and YouTube surfaces.

Google Analytics

Google Analytics is used to analyse how our website is used, for example which pages and products are viewed and how users interact with our shop.

Google Ads and Conversion Tracking

Google Ads and conversion tracking may be used to display advertising campaigns and measure their effectiveness.

Where cookies, tracking technologies or comparable access to your terminal device are used, processing is carried out only with your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

20. Meta Pixel

Where applicable, we use the Meta Pixel in connection with Facebook and Instagram.

Provider:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

The Meta Pixel may in particular be used to measure interactions with our website, record conversions, evaluate advertising campaigns and create advertising audiences.

Where consent is required, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

21. TikTok Pixel

Where applicable, we use the TikTok Pixel to measure and optimise our TikTok advertising.

Provider:
TikTok Technology Limited
10 Earlsfort Terrace
Dublin 2, D02 T380
Ireland

Device, usage, interaction, conversion and marketing data may in particular be processed.

Where consent is required, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

22. Pinterest Tag

Where applicable, we use the Pinterest Tag to measure and optimise our Pinterest marketing activities.

Provider for users in the EEA:
Pinterest Europe Ltd.
Palmerston House, 2nd Floor
Fenian Street
Dublin 2
Ireland

Device, usage, interaction, product, conversion and marketing data may in particular be processed.

Where consent is required, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

23. Applications

If you apply for a position with us, for example by email to HR@ms-sucra.de, we process the application data you provide for the purpose of carrying out the application procedure.

This may include in particular your name, contact details, cover letter, CV, certificates and other application documents.

The processing is carried out in particular on the basis of Art. 6(1)(b) GDPR and Section 26 of the German Federal Data Protection Act (BDSG).

If no employment relationship is established, we generally delete application documents no later than six months after completion of the application process, unless statutory reasons require longer storage or you have consented to longer retention.

24. Social Media Profiles

We maintain business profiles on various social networks, in particular Instagram, Facebook, LinkedIn, TikTok and Pinterest.

If you visit or interact with our profiles, profile, usage, communication and interaction data may in particular be processed.

Our processing is carried out in particular on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in communicating with customers and interested parties and presenting our business.

The respective platform providers may also process data for their own purposes. Their respective privacy policies therefore apply in addition.

Relevant providers include in particular:

• Meta Platforms Ireland Limited for Facebook and Instagram
• LinkedIn Ireland Unlimited Company for LinkedIn
• TikTok Technology Limited for TikTok
• Pinterest Europe Ltd. for Pinterest

25. External Links

Our website may contain links to external websites and services. If you follow such a link, the privacy provisions of the respective provider apply.

The respective operator is generally responsible for processing carried out on external websites that are outside our control.

26. Minors

Our services are not specifically directed at children.

We do not knowingly collect personal data from children for marketing purposes. If we become aware that personal data relating to a child has been processed without the required consent or another valid legal basis, we will take appropriate measures.

27. International Data Transfers

In connection with individual services, personal data may be processed outside the European Union or European Economic Area, in particular where internationally operating providers such as Shopify, Google, Meta, TikTok or Pinterest are involved.

Such transfers take place only where the requirements of Art. 44 et seq. GDPR are met.

Relevant safeguards may include in particular:

• an adequacy decision by the European Commission,
• Standard Contractual Clauses adopted by the European Commission,
• other appropriate safeguards, or
• where legally permitted in exceptional circumstances, your explicit consent.

Where a provider is validly certified under a data protection framework recognised by the European Commission, a transfer may also take place on the basis of the corresponding adequacy decision.

28. Changes to this Privacy Policy

We update this Privacy Policy when statutory requirements, our website, our online shop, the services we use or our data processing activities change.

The current version published on our website applies.

Version: 4 September 2026