Privacy Policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Savin Kumar Kapoor
Indian Culture
Altländer Straße 32
21614 Buxtehude
Germany

Email: info@indian-culture.de

2. Overview of Processing

We process personal data only insofar as this is necessary to provide a functional online shop, our content, and services. Personal data is generally processed only with user consent or where processing is permitted by law.

3. Data Collected

The following personal data is collected when using our shop:

3.1 During registration:

• Email address (required). It is your access to your account, and we use it to confirm your registration.
• Password (required). It is stored solely in encrypted form by our authentication service and cannot be viewed by us.
• Full name (required). We need it to deliver your order and to issue your invoice.
• Phone number (optional). We use it for queries about delivery and to prevent single-use welcome discount codes from being redeemed more than once. We do not call you for marketing purposes. Without this information you can use your account without any restriction.
• Delivery address with street and house number, postcode and city (optional). You can save it now so that your later order is quicker, or provide it only when you place an order. Germany is stored automatically as the country, as we currently deliver within Germany only. You do not need to enter it.
• Your acceptance of the Terms and Conditions and your indication of whether you wish to receive emails from us. For both we store the time and the version identifier of the text shown to you.
• Personal discount code. This is assigned to your account automatically on registration.

Legal bases: For email address, password and name Art. 6(1)(a) GDPR, your consent. A customer account is optional; you can also order as a guest (section 3.2). By creating the account, you consent to us storing this data to set up and operate your account. You can withdraw your consent at any time by deleting your account; the lawfulness of processing carried out before then remains unaffected. What we need for an order and must retain is governed by sections 3.2 and 11. For the phone number Art. 6(1)(f) GDPR, our legitimate interest in smooth delivery and in protection against repeated redemption; you may object to this processing under Art. 21 GDPR. For the delivery address Art. 6(1)(a) GDPR, consent. You may withdraw this consent at any time by deleting the information in your account or by writing to us at info@indian-culture.de. The lawfulness of processing carried out before the withdrawal remains unaffected.

Obligation to provide: You are not obliged to give us this data. Without the information marked as required we cannot set up a customer account for you; you can then order as a guest. You may omit any information marked as optional. This does not put you at any disadvantage; in particular, it changes neither your discount code nor its amount.

3.2 When placing an order: Order data (products, quantities, prices), payment information (processed directly by Stripe, we do not store credit card data), delivery address, IP address

Ordering as a guest: You can order without a customer account. For this we only ask for what we need for the contract: your name, your email address and your delivery address with street and house number, postcode and town; as the country we store Germany. We send the order confirmation, the shipping notice and the request for a review (section 9d) to the email address. Stripe additionally receives your name and delivery address (section 6). We do not create an account for you and do not link the order to an account, not even if you later create one with the same email address. After payment, you can create a customer account with a password on the confirmation page; for this we take your name, email address and address from what you entered (section 3.1), and the guest order stays separate. Legal basis: Art. 6(1)(b) GDPR, performance of the contract, and Art. 6(1)(c) GDPR for retention. How long we store the data is set out in section 11.

Protection against misuse when ordering as a guest: To stop anyone from testing other people's payment cards with automated orders or overloading our checkout, we count per day how often guest orders are placed from an IP address and with an email address. For this we store only a checksum (HMAC-SHA-256 with a secret key), which contains neither the IP address nor the email address in plain text, plus the day and the count. We delete the count for a day on the day after next. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in preventing fraud and misuse. You may object to this processing under Art. 21 GDPR.

3.3 When visiting the website: IP address, browser type and version, operating system, screen resolution, referrer URL, pages visited, date and time of access, time spent, click behavior

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance), Art. 6 para. 1 lit. f GDPR (legitimate interest), Art. 6 para. 1 lit. a GDPR (consent).

3.4 When joining the waiting list:

Before our shop opens on 1 October 2026, you can join our waiting list without a customer account. In doing so, we process:

• Email address (required). We send the confirmation link to it and, once you have confirmed, our messages.
• Time of the entry, time of your confirmation, the IP address from which you clicked the confirmation link, and the version identifier of the consent text shown to you. This information serves as proof of your consent.
• Language of the page (German or English), so that we write to you in that language.
• Source of the entry as a broad category: TikTok, Instagram or direct. It is derived from the link through which you reached the page. We do not store the address of the previous page.
• Time at which we handed the opening announcement to our email service provider, so that you receive this message only once.

Purpose: With your consent, we first send you the opening announcement, then offers and news about our range. If you later create a customer account with the same email address, we compare the address with the waiting list. This is how we determine whether you are entitled to the 15 % discount for entries confirmed by 30 September 2026. The data is stored with Supabase (section 5.2); we send the emails via Resend (section 9).

Legal bases: For sending the emails Art. 6(1)(a) GDPR, your consent. For the information proving your consent Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. For the comparison when you create an account Art. 6(1)(b) GDPR, as this is how we grant the promised discount. For the source of the entry and the checksum mentioned below Art. 6(1)(f) GDPR, our legitimate interest in knowing how visitors find us and in permanently respecting your withdrawal. You may object to processing based on legitimate interest under Art. 21 GDPR.

Withdrawal: You may withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or informally at info@indian-culture.de. When you unsubscribe, we delete your entry immediately, including the information proving your consent. We keep a checksum (SHA-256) of your email address, which does not contain your address in plain text. It lets us recognise when the same address is entered again, and we send no further messages to it. If you confirmed your entry by 30 September 2026, we also keep the time of your confirmation together with the checksum until 31 October 2026. This way you keep the 15 % discount if you create a customer account afterwards (Art. 6(1)(b) GDPR). After that, this address cannot be entered again. If you would like to rejoin, please write to us. The lawfulness of processing carried out before the withdrawal remains unaffected.

Retention: We delete unconfirmed entries automatically 30 days after the entry. We store confirmed entries until you withdraw your consent. We store the checksum after unsubscribing indefinitely, so that your withdrawal is permanently respected. We keep the time of your confirmation after unsubscribing only if you confirmed by 30 September 2026, and only until 31 October 2026.

Obligation to provide: Joining is voluntary. Without an email address we cannot add you to the waiting list.

4. Purpose of Data Processing

We process your data for the following purposes:

• Execution and processing of orders and deliveries
• Creation and management of your customer account
• Answering your enquiries via the contact form
• Communication regarding your orders (order confirmation, shipping notification)
• Sending newsletters and discount codes (only with your express consent)
• Analysis and improvement of our website and offerings
• Prevention of abuse and fraud
• Fulfillment of statutory retention obligations
• Sending the announcement of our shop opening, provided you consented during registration
• Proof of your consent to receive emails
• Requesting a review after delivery and publishing your review (section 9d)
• A message when a sold-out product is available again, if you asked for it (section 9e)
• Receiving and handling your withdrawal from a contract (section 9f)

5. Hosting and Infrastructure

5.1 Vercel (Hosting): Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes access data (IP address, time of access) to provide the website. Legal basis: Art. 6 para. 1 lit. f GDPR. Vercel is certified under the EU-US Data Privacy Framework.

5.2 Supabase (Database): Our customer and order data is stored with Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992, in the EU region Ireland (eu-west-1). Data is transmitted and stored encrypted. Legal basis: Art. 6 para. 1 lit. b GDPR. A data processing agreement under Art. 28 GDPR exists with Supabase.

Your login credentials are managed by Supabase in a separate area distinct from your customer account. In addition to your email address and your encrypted password, the information provided during registration is stored there.

6. Payment Service Provider

Stripe: For payment processing, we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you make a payment, your payment data is transmitted directly to Stripe. We do not receive or store complete credit card numbers or bank details. Stripe processes your data for fraud prevention purposes, among others.

We pass your email address and the amounts of the order to Stripe. If you order as a guest, we also pass your name and delivery address, because Stripe uses them to detect payment card fraud.

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance), for name and delivery address in a guest order Art. 6 para. 1 lit. f GDPR, our legitimate interest in preventing payment fraud. Stripe's privacy policy: https://stripe.com/privacy

7. Cookies and Browser Storage

We store information on your device, either as a cookie or in your browser's storage (localStorage and sessionStorage). Section 25 of the German TDDDG applies to both.

7.1 Necessary storage: Without your consent, we only store what is needed for features you use yourself: your shopping cart and favourites, your login to your customer account, which notices in your account you have already seen, your choice in the cookie banner and, if you switch the language, the language you chose. We store the language as a cookie for one year. Everything else stays in your browser's storage until you log out or delete the site data in your browser. If you order as a guest, we put your name, email address and address in sessionStorage so that the confirmation page can show them after payment; they expire when you close the tab. Legal basis for storing and reading: Section 25 (2) No. 2 TDDDG. Legal basis for further processing: Art. 6 para. 1 lit. b GDPR where your order or customer account is concerned, otherwise Art. 6 para. 1 lit. f GDPR, our legitimate interest in providing the website with the features you use.

7.2 Analytics: Only if you agree in the cookie banner do we analyse how you use our shop (details in section 8). For this, we place a random ID in localStorage by which we recognise your browser on later visits; it remains until you withdraw your consent or delete the site data in your browser. Legal basis: Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR, your consent.

7.3 Settings and withdrawal: On your first visit, a banner asks whether you agree to analytics and to personal recommendations (section 7.5). "Accept All" agrees to both, "Reject All" declines both, and under "Customize" you choose each one separately. As long as you have not agreed, no analytics take place and your browser does not remember any viewed products. You can withdraw your consent at any time via the "Cookie Settings" link at the bottom of every page. The withdrawal applies from then on; the lawfulness of processing carried out before it remains unaffected.

7.4 Proof of your choice: So that we can demonstrate whether and to which text you consented, we also store your choice in the banner on our side: the time, whether you consented to or declined analytics and personal recommendations, the version and language of the banner text, device type, browser and operating system. When you consent and when you withdraw, we also store the random ID from section 7.2. If you are logged in, we store your customer account with it; a choice you made before logging in is linked to your account when you log in. If you decline analytics without being logged in and without having consented before, we store nothing on our side, even if you agree to personal recommendations; the list of products you viewed then stays only in your browser. The data is stored with Supabase (section 5.2). Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, our obligation to be able to demonstrate consent. If you delete your customer account, we remove the link to your account.

7.5 Personal recommendations: Only if you agree in the cookie banner does your browser remember in localStorage which products you view: no more than the last 12, each for no more than 30 days. When you open the cart, we send this list together with your cart to our server. It uses it to choose the suggestions in the cart: products you viewed but did not add to the cart, and products that other visitors viewed together with them, ranked by how often they are viewed in the shop. These figures come from the analytics described in section 8 and are totals; they do not identify any individual visitor. We do not store your list on the server; it stays only in your browser. You can delete it in the cart; if you withdraw your consent, your browser deletes it immediately. Recommendations do not depend on analytics: you can agree to one and decline the other. Without your consent, the cart only suggests what is missing for a dish in your cart or what is often viewed in the shop. Legal basis: Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR, your consent.

8. Website Tracking and Analysis

With your consent (section 7.2), we use our own tracking system to record how our shop is used: pages viewed and search terms, time spent, scroll depth, clicks, which form fields you click on (but not what you enter), what you add to or remove from the cart, whether you go to checkout and buy, device (device type, browser, operating system, screen size), the page you came from and the campaign, if the link carries a campaign tag.

We also record your approximate location: country, region and city. Our host Vercel (section 5.1) derives it from your IP address with each request and passes it on to us. We store only the country, region and city, not your IP address.

With each entry we store the random ID from section 7.2. It tells us which visits come from the same browser. This creates a personal usage profile across several visits. If you are logged in to your customer account, we also store your customer ID; the profile is then linked to your account. If you place an order, with an account or as a guest, we link the profile to your order, for example to see which page brought you to us and how many visits it took until the purchase. The data is therefore not anonymous.

The data is kept in our database at Supabase (section 5.2), which processes it on our behalf. We analyse it ourselves only, to improve the shop, and do not share it with third parties. We do not use analytics or advertising services of other providers (such as Google Analytics). We delete the data automatically after 12 months.

Legal basis: Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR, your consent. You can withdraw it as described in section 7.3.

Recipe views: Regardless of your consent, we count how often each recipe is viewed. For this we store only one number per recipe and day, no IP address, no ID and no information about you, and we do not set a cookie for it. We do not count search engines and other programs that we recognise by their browser identifier, link previews, pages loaded in advance or views by logged-in staff. With the figures of the last 90 days we choose which recipe appears on a product page when several fit. Legal basis: Art. 6 para. 1 lit. f GDPR, our legitimate interest in showing the recipes our visitors read most often.

Visits from AI services: Also regardless of your consent, we count how often someone reaches us through a link in an AI service such as ChatGPT, Perplexity, Gemini or Copilot. We recognise the service by the address of the page you come from, or by the campaign parameter the service itself adds to the link. We store only one number per day, service and page viewed, no IP address, no ID and no information about you, and we do not set a cookie for it. We do not count the same requests as for recipes. Legal basis: Art. 6 para. 1 lit. f GDPR, our legitimate interest in knowing which of our pages AI services link to in their answers.

9. Newsletter and Email Service

For sending transactional emails (order confirmations, shipping notifications, password reset) and newsletters, we use Resend, Inc., 2261 Market Street #4732, San Francisco, CA 94114, USA. Resend is certified under the EU-US Data Privacy Framework. The request for a review after delivery (section 9d) and the message that a sold-out product is available again (section 9e) are also sent via Resend.

Resend stores every email we send there, with the recipient address, the content and the delivery log, for 30 days and then deletes it; in backups the data remains for at most seven days longer. The data is stored in the USA.

With your express consent (double opt-in), you will receive our newsletter with information about new products, recipes, and special offers.

For each newsletter we keep a list of its recipients. It records which customer account it is to go to, in which language, and how far sending to you has got: whether, when and in which part of the send we handed the email to Resend, and whether this failed. This way you receive each newsletter only once, even if sending is interrupted. As soon as you unsubscribe or delete your customer account, and at the latest 30 days after the newsletter was sent, we remove the link between this information and you; after that it only counts in the total per newsletter.

If you consented during registration, we will send you news and offers by email. This includes the announcement of our shop opening.

As proof of your consent we store the time of your registration, the version identifier of the text shown to you, and the time of your confirmation via the confirmation link. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, our obligation to be able to demonstrate consent.

You can revoke your consent at any time via the unsubscribe link in every newsletter email or by writing to info@indian-culture.de. Legal basis for newsletter: Art. 6 para. 1 lit. a GDPR (consent). Legal basis for transactional emails: Art. 6 para. 1 lit. b GDPR (contract performance). A data processing agreement under Art. 28 GDPR exists with Resend.

Undeliverable addresses and spam reports: Resend tells us when an email from us to your address could permanently not be delivered, when Resend did not send it because your address is blocked there, or when you reported it as spam. This applies to all emails we send via Resend. We then store your email address, the type of report, its time, the reason given by Resend or by the receiving mail server, the identifier of the email at Resend and, for a newsletter, which newsletter it was. Resend also puts such an address on a suppression list and then no longer sends it any email from us, not even an order confirmation. We no longer send newsletters to such an address. If you report a newsletter as spam, we treat this as a withdrawal of your consent and unsubscribe you from the newsletter. If you report any email from us as spam, we also no longer send you a request for a review (section 9d). For a newsletter, we also note the type of report in the list of its recipients; 30 days after sending we remove the link between this note and you, after which it only counts in the total per newsletter.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in not sending emails to addresses that do not reach their recipient or that the recipient does not want to receive. You can object to this processing under Art. 21 GDPR. Retention: we delete the report as soon as you confirm the newsletter again, because the confirmation email has then reached you. We also delete it as soon as your address no longer belongs to a customer account or an entry on our waiting list, for example because you delete your customer account or ordered as a guest, at the latest on the following day. At the same time we lift the suppression at Resend. If you switch the newsletter back on in your customer account, we lift the suppression at Resend immediately so that the confirmation email reaches you; a suppression we set manually remains.

9a. Telegram Notifications (internal)

For internal order processing, we transmit the following data via Telegram Bot to our shipping department upon receipt of an order: name, delivery address, order number, and order contents. This transmission is provided by Telegram Messenger Inc., 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. Telegram operates its servers primarily in Europe.

When a withdrawal is received (section 9f), we transmit in the same way your name, the email address you gave with it, the order number, the withdrawn items and your note, if you wrote one.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient order processing). Telegram Privacy Policy: https://telegram.org/privacy

9b. Abuse Prevention for Discount Codes

To prevent multiple redemptions of one-time welcome discount codes, we store a cryptographic hash (SHA-256) of your email address and phone number after such a code has been used. These hashes cannot be reverse-engineered to the original data and serve solely as comparison values for future redemption attempts.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in fraud prevention). Retention period: indefinite, to permanently prevent multiple redemptions.

9c. Contact Form

When you write to us via the contact form, we process your name, your email address, the subject (optional) and your message. If you are signed in, we use the email address of your customer account. We forward this information by email to our mailbox info@indian-culture.de and send you a confirmation of receipt that does not contain the content of your message. We send both emails via Resend (section 9). We do not store the content of your message in our database.

Purpose and legal basis: We answer your enquiry. If it concerns an order or a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Abuse prevention: For each enquiry we store the time, a checksum (SHA-256) of your email address that does not contain your address in plain text, and whether we sent you a confirmation of receipt. This lets us limit the number of enquiries per hour and send no more than one confirmation of receipt to the same address within 24 hours. It prevents anyone from using the form to flood other people's mailboxes. For the same purpose we briefly count enquiries per IP address; we do not store the IP address in our database. Legal basis: Art. 6(1)(f) GDPR. You may object to this processing under Art. 21 GDPR.

Retention: We delete the time and checksum once they are older than 24 hours, at the latest after 48 hours. Your message remains in our mailbox for as long as we need it to handle your enquiry. If it concerns an order, we keep it as a business letter for six years (section 11).

Obligation to provide data: Without your name, email address and message we cannot accept your enquiry via the form. You can also write to us directly at info@indian-culture.de.

9d. Reviews

After an order has been delivered, you can review the products you bought and your purchase from us as a whole, that is shopping, delivery and service. About three days after delivery we send you an email with a link to your order for this purpose. We send the email via Resend (section 9).

Review via a link: If you buy from us without ordering through the website, we send you a link through which you can review our shop as a whole, not individual products. You enter your first name yourself; we store only the first part of it, plus your ratings, heading and text as for the review of a whole order, the language, the time and which link the review came through, but no order and no customer account. Before approving it, we check that you bought from us. It is published like the review of a whole order on our home page, with a note that you bought from us. To stop anyone from sending reviews in bulk, our server counts for one hour how many reviews come from an IP address; for this the IP address is kept only in working memory and is not stored. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in preventing misuse.

What we store: your rating from 1 to 5, optionally a heading and a text, plus the reviewed product, your order, for an order with a customer account the link to that account, the language and the time. If you review your whole order, instead of the product we also store, optionally, how fast the parcel arrived, which of our recipes you used and how well it turned out, and whether you would recommend us, each from 1 to 5. As your name we take the first part of the name in your order, usually your first name. The data is stored at Supabase (section 5.2).

What is published: We read every review before it appears. Once approved, the product page shows your first name, the rating, heading and text, the date and a note that you bought the product from us. The same details are included in machine-readable form in the page source so that search engines can display them. The review of your whole order does not appear on a product but on our home page: your first name, your ratings, the recipe you used, heading, text and the month of the review. If you rated a recipe, that rating also counts on the recipe page, without your name: it shows the number of ratings, since when they have been counted and, from three ratings, the average, also in machine-readable form in the page source.

Purpose and legal bases: We show other customers genuine experiences with our products. For storing and publishing your review, Art. 6(1)(a) GDPR, your consent, which you give by submitting the review. You can withdraw it at any time by writing to info@indian-culture.de; we will then delete the review. The lawfulness of processing carried out before the withdrawal remains unaffected. For the email asking for a review, Art. 6(1)(f) GDPR, our legitimate interest in feedback on our products. You may object to this processing under Art. 21 GDPR.

Objecting to the email: We send the request for a review without separate consent to customers who have bought from us (Section 7(3) of the German Act against Unfair Competition, UWG). We point this out when you register, in the cart before you order, including when you order as a guest, and in every one of these emails. You can object at any time via the link in the email or by writing to info@indian-culture.de. This costs you nothing beyond the transmission costs at basic rates. If you report any email from us as spam, we also treat this as an objection (section 9). If you object, we store a checksum (SHA-256) of your email address, which does not contain your address in plain text, and the time, we no longer send a request for a review to this address, including for future orders, and we no longer pass your orders to Trustpilot. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in permanently respecting your objection. We keep the checksum for as long as we send review emails.

Invitation from Trustpilot: One week after our email asking for a review, we transmit your first name, your email address and the order number to Trustpilot. Trustpilot is a review platform operated by Trustpilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen K, Denmark. With this data Trustpilot sends you, on our behalf, an email inviting you to review our shop there. Trustpilot acts as our processor (Art. 28 GDPR) and keeps this data for at most two years. Trustpilot may use sub-processors; data only goes to countries outside the European Economic Area if there is an adequacy decision of the European Commission or standard contractual clauses of the European Commission. We transmit the data by email via Resend (section 9). The purpose is reviews that Trustpilot marks as verified and that can count towards our shop’s star rating on Google. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in verifiable reviews of our shop. You can object in the same way as to our email (see above); if you object within that week, we transmit nothing to Trustpilot. If you write a review on Trustpilot, Trustpilot processes it under its own responsibility and its own privacy policy.

Trustpilot link after a review via our review link: The page after you submit a review via a link (see above) contains a link to our page on Trustpilot. A button there can copy your text to your device’s clipboard; the text stays on your device. We do not transmit any data to Trustpilot in doing so. Only when you open the link does Trustpilot process data under its own responsibility and its own privacy policy.

Retention: We store product reviews until you ask us to delete them or the product is deleted from our shop, the review of your whole order until you ask us to delete it or the order is deleted, and a review via a link until you ask us to delete it. We automatically delete reviews that we do not publish 30 days after our decision. If you delete your customer account, a review with your first name remains; we will delete it too on request.

Obligation to provide data: A review is voluntary. Without a rating from 1 to 5 we cannot accept it.

9e. Message when a product is available again

If a size is sold out, you can enter your email address on the product page. We then send you a single email as soon as this size is available again. Before that we send you a link with which you confirm that the address is yours; only then does your entry take effect. If you are signed in, the address of your customer account is already in the field, and you can change it. We send both emails via Resend (section 9).

If the address of your customer account is confirmed and you leave it in the field, there is no link: your entry takes effect when you click Notify me, and we do not send you an email beforehand. As the time and IP address of your confirmation we then store those of this click.

What we store: your email address, the size you want, the language of the page, the time of the entry, the time of your confirmation, the IP address from which you confirmed, and the identifier of the version of the consent text shown to you. The data is stored at Supabase (section 5.2).

Purpose and legal bases: We send you the message you asked for. It contains the note that the size is available again and a link to the product. The legal basis is Art. 6(1)(a) GDPR, your consent. For the details that prove your consent, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Withdrawal: You can withdraw your consent at any time with effect for the future, via the cancel link in the confirmation email, as a signed-in customer also on the product page and in your customer account, or by writing to info@indian-culture.de. We then delete your entry immediately, including the details that prove your consent. The lawfulness of processing carried out before the withdrawal remains unaffected.

Retention: We delete unconfirmed entries seven days after the entry. Once the message has been sent, we delete the entry immediately. If the size does not come back within six months of your confirmation, we delete the entry without a message. If the size is deleted from our shop, we delete the entry along with it. If you delete your customer account, we delete all entries with the address of your account, including those you made via the confirmation email.

Obligation to provide data: The entry is voluntary. Without an email address we cannot notify you.

9f. Withdrawal from a contract

On the "Withdraw from contract" page you can withdraw from an order in whole or in part (Section 356a of the German Civil Code, BGB). You do not need a customer account for this. You enter your order number and the email address of the order. If both match a paid order, we send a link to this address that is valid for 30 minutes and can be used for one withdrawal. Via the link you see the items of the order and choose what you withdraw. We send the link to the email address of the order. We send the confirmation of receipt of your withdrawal to the email address you enter in the form and, if it differs, also to the email address of the order. Both are sent via Resend (section 9).

What we store: For the link, the email address of the order, a checksum (SHA-256) that does not contain the link in plain text, the time it was sent, when it expires and whether it was used. For the withdrawal, your name, the email address you give for the confirmation of receipt and for queries, the order number, the withdrawn items and quantities, your note if you write one, the language, the time of receipt and a withdrawal number we assign. While handling it, we add our decision, the receipt of the returned goods or your proof that you sent the goods, such as the tracking number, the amount and time of the refund and, if we claim one, compensation for loss in value with the reason. The data is stored at Supabase (section 5.2). We also receive name, email address, order number, items and note via Telegram (section 9a).

Abuse prevention: So that no one can try out order numbers and email addresses, the page always gives the same answer, whether an order was found or not, and we send no more than three links for an order within 24 hours. In addition, our server counts for five minutes how many requests come from an IP address; for this the IP address is kept only in working memory and is not stored.

Legal bases: For receiving your withdrawal and the confirmation of receipt, Art. 6(1)(c) GDPR in conjunction with Section 356a(2) and (4) BGB. For unwinding the order, that is the return, refund and compensation for loss in value, Art. 6(1)(b) GDPR. For the link, abuse prevention and the Telegram message, Art. 6(1)(f) GDPR, our legitimate interest in showing the details of your order only to you, preventing misuse and handling your withdrawal quickly; you may object to this processing under Art. 21 GDPR. For retention, Art. 6(1)(c) GDPR in conjunction with § 147 AO.

Retention: We delete the link after two days, at the latest after three. We keep the withdrawal as a business letter for six years and, after a refund, as an accounting record for eight years, in each case counted from the end of the calendar year in which the withdrawal was received or we made the refund (§ 147(1) nos. 2 to 4, (3) and (4) AO). We then delete it automatically. This also applies if you delete your customer account or if, for a guest order, we have already deleted your email address from the order (section 11).

Obligation to provide data: Without order number, email address and name we cannot accept your withdrawal via this page. You can also withdraw in another way, for example by email to info@indian-culture.de.

10. Sharing Data with Third Parties

Your data is shared with third parties only in the following cases:

• With the shipping provider (Hermes, for parcels over 10 kg DHL) for delivery of your order (name, address)
• With the payment service provider (Stripe) for payment processing
• With the email service provider (Resend) for sending transactional emails, review requests, messages about products that are available again and newsletters
• When we are legally obligated to do so (e.g., to tax authorities)

Apart from this, we do not share your data with third parties unless you have expressly consented.

11. Retention Period

Personal data is stored only for as long as necessary for the respective purpose or for statutory retention periods:

• Customer account data including your personal discount code: Until deletion of the account by the customer
• Customer account whose email address you have never confirmed via the link in our email: deleted 30 days after it was created. This does not apply if you have confirmed the newsletter within that time; the account then remains until you delete it.
• Order data and invoices: eight years, counted from the end of the calendar year in which the invoice was issued (§ 147(1) no. 4 and (3) of the German Fiscal Code (AO), § 14b(1) of the German VAT Act (UStG))
• Order data after you delete your account: we remove your email address and the link to your account immediately. Your name and address remain in your orders because they are part of the invoice, which we must keep unchanged. Until the end of the retention period we use them only for this purpose and delete them afterwards (Art. 17(3)(b) GDPR).
• Orders as a guest: we delete your email address two years after delivery, or two years after the order if no delivery is recorded; until then we need it for questions about withdrawal and warranty. Your name and address remain until the end of the retention period for invoices, because they are part of the invoice, and are deleted afterwards. If a guest order is not paid, we delete name, email address and address after eight days.
• Protection against misuse when ordering as a guest: the count for a day until the day after next (section 3.2)
• Business letters, such as emails about an order: six years (§ 147(1) nos. 2 and 3 and (3) AO)
• Contact form: time and checksum of the email address for no more than 48 hours (section 9c)
• Reviews: until you ask us to delete them or the product is deleted from our shop, for the review of the whole order the order, for a review via a link until you ask us to delete it; reviews we do not publish 30 days after our decision (section 9d)
• Message when a product is available again: unconfirmed entries seven days after the entry; confirmed entries until the message is sent, at most six months after your confirmation (section 9e)
• Withdrawal from a contract: the link to the withdrawal page two days, at the latest three; the withdrawal six years, after a refund eight years, in each case from the end of the calendar year in which it was received or we made the refund (section 9f)
• Tracking data: 12 months, then automatic deletion
• List of viewed products for personal recommendations (section 7.5): only in your browser, each product for no more than 30 days, until you delete the list or withdraw your consent
• Proof of your choice in the cookie banner (section 7.4): three years; longer as long as we still store tracking data for the random ID from section 7.2, then automatic deletion
• Newsletter data: Until revocation of consent; the proof of consent named below is excluded from this
• List of recipients of a newsletter: until you unsubscribe or delete your customer account, at most 30 days after the newsletter was sent; after that only totals per newsletter remain, with no link to you (section 9)
• Analysis of newsletter clicks: which links you clicked and whether you ordered afterwards, until you switch off the analysis or delete your account, at most 12 months after the newsletter was sent; after that only totals per newsletter remain, with no link to you
• Unconfirmed registrations: deleted 30 days after registration if the confirmation link has not been used
• Delivery address without an order: until you delete it in your account or delete your account
• Proof of consent to receive emails and to the analysis of newsletter clicks: three years after your withdrawal; the waiting list is excluded, see below
• Waiting list: unconfirmed entries 30 days after the entry; confirmed entries until your withdrawal, then immediate deletion including the proof; the checksum of the address indefinitely; if confirmed by 30 September 2026, the time of confirmation until 31 October 2026 (section 3.4)
• Reports of undeliverable addresses and spam: until you confirm the newsletter again or until your address no longer belongs to a customer account or an entry on our waiting list, then at the latest on the following day (section 9); the suppression at Resend for the same period, unless you switch the newsletter back on in your customer account
• Emails and delivery logs at Resend: 30 days, in backups at most seven days longer (section 9)

12. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): You can request information about the data we have stored about you.
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data, provided no statutory retention obligations conflict.
• Restriction (Art. 18 GDPR): You can request the restriction of processing.
• Data portability (Art. 20 GDPR): You can receive your data in a structured format.
• Objection (Art. 21 GDPR): You can object to the processing of your data.
• Revocation (Art. 7 para. 3 GDPR): You can revoke consent given at any time.

To exercise your rights, please contact: info@indian-culture.de

13. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

Responsible supervisory authority:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
www.lfd.niedersachsen.de

14. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the browser address line changing from "http://" to "https://" and the lock symbol in your browser bar.

15. Changes to This Privacy Policy

We reserve the right to adapt this Privacy Policy to always meet current legal requirements or to implement changes to our services. For your renewed visit, the current version applies.