Privacy policy

Last updated: May 15, 2026

Please read this Privacy Policy carefully. By using and accessing any of our services, you confirm that you have read this Privacy Policy and agree to the collection, use, and sharing of your data as described herein.

1. Introduction

We respect your privacy and protect your personal data. In this Privacy Policy, we want to explain what personal data we collect, for what purposes we use it, and how you can exercise your rights.

2. Data Controller

The party responsible for processing personal data is:

Selah POSTFLEX PFX-046-186 Emsdettener Straße 10 48268 Greven Germany

Email: contact@s-elah.com

3. Hosting & Platform

Our website is operated through the e-commerce platform Shopify.

Provider: Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada

Shopify provides us with the technical infrastructure for our online store. In doing so, Shopify also processes personal data in Canada and the United States. For Canada, an adequacy decision by the European Commission is in place. For other third countries, protection is ensured through standard contractual clauses in accordance with Art. 46 GDPR.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) Art. 6(1)(f) GDPR (secure and stable operation)

A Data Processing Agreement (DPA) has been put in place.

4. Collection and Use of Personal Data

(1) What data we collect

We collect personal data when you:

  • place a product order
  • create a customer account
  • contact us
  • sign up for our newsletter

The following data may be processed:

  • Name
  • Address (billing and delivery)
  • Email address
  • Phone number
  • Payment data (e.g. credit card, PayPal – processed via payment service providers)
  • Order and contract data

(2) Purposes of processing

Data is processed for the following purposes:

  • Processing orders and deliveries
  • Contract fulfillment and customer service
  • Communication in response to inquiries
  • Improving our offerings and website
  • Sending information and offers only with your consent

5. Legal Bases for Processing

The processing of your data is based on the following legal grounds:

  • Art. 6(1)(b) GDPR – Performance of a contract (orders, delivery, payment)
  • Art. 6(1)(a) GDPR – Consent (e.g. newsletter, analytics cookies)
  • Art. 6(1)(c) GDPR – Legal obligations (tax and commercial law)
  • Art. 6(1)(f) GDPR – Legitimate interests (website security, optimization)

6. Cookies & Analytics

Our website uses cookies in order to:

  • ensure core functionality (e.g. shopping cart, checkout)
  • improve the user experience
  • analyze how our website is used

Types of cookies:

  • Technically necessary cookies
  • Analytics cookies (only with consent)

Legal bases:

  • Necessary cookies: Art. 6(1)(f) GDPR
  • Analytics cookies: Art. 6(1)(a) GDPR in conjunction with § 25 TTDSG

Consent is obtained via a cookie consent banner and can be withdrawn at any time.

7. Newsletter

If you sign up for our newsletter, we process your email address (and your name where applicable).

You can unsubscribe at any time via the link included in every newsletter.

Legal basis: Art. 6(1)(a) GDPR

8. Retention Period and Security of Your Data

We store personal data only for as long as necessary for the relevant purposes or as required by statutory retention obligations:

  • Order and contract data: 10 years in accordance with § 147 AO and § 257 HGB (statutory tax and commercial retention requirements)
  • Customer account data: Until the account is deleted, provided no statutory retention obligations apply
  • Newsletter consent: Until consent is withdrawn; consent records are retained for 3 years following withdrawal
  • Contact inquiries: 3 years from the conclusion of communication (limitation period pursuant to § 195 BGB)
  • Cookies and analytics data: In accordance with the respective cookie lifespan or until consent is withdrawn

9. Your Rights

Under applicable law, you have the following rights:

Right of access (Art. 15 GDPR): You have the right to request information at any time about whether and what personal data we process about you.

Right to rectification (Art. 16 GDPR): You have the right to have inaccurate or incomplete personal data corrected.

Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided no statutory retention obligations prevent this.

Right to restriction of processing (Art. 18 GDPR): You have the right to request that the processing of your personal data be restricted.

Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used and machine-readable format, or to request its transfer to another controller.

Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data where it is based on legitimate interests.

Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent you have given to the processing of your personal data at any time with effect for the future.

Right to lodge a complaint: You have the right to lodge a complaint with a competent data protection supervisory authority.

10. Data Security

We implement appropriate technical and organizational measures (e.g. SSL encryption) to protect your data against unauthorized access, loss, or misuse.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy where required due to technical or legal changes.

12. Contact

If you have any questions about our data protection practices or this Privacy Policy, or if you wish to exercise any of your rights, please contact us at:

Email: contact@s-elah.com