Privacy policy
Last updated: 1 October 2026
Below we inform you about the processing of your personal data when you visit and use our online shop lacueor.com. Personal data is any information relating to an identified or identifiable natural person.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is Finor GmbH, Kurfürstendamm 194, 10707 Berlin, Germany, e-mail info@lacueor.com.
2. Shop platform and hosting
Our shop runs on the Shopify platform, provided by Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes on our behalf all data arising when you visit the shop, create a customer account or place an order, and stores it on servers that may be located outside the EU (Shopify Inc., Canada; Shopify Inc. and sub-processors in the USA). An EU adequacy decision exists for Canada; transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. We have concluded a data processing agreement with Shopify under Art. 28 GDPR. More information: https://www.shopify.com/legal/privacy.
3. Access data and server logs
When you access the shop, Shopify automatically processes on our behalf your browser type and version, operating system, page accessed, previously visited page, IP address and date and time of access. This data is required to deliver the shop, ensure its security and detect misuse (Art. 6 (1) (f) GDPR). It is deleted after twelve months at the latest.
4. Cookies and consent management
We use cookies and similar technologies. Strictly necessary cookies (e.g. for cart, login, language selection and storing your consent) are set on the basis of Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) (f) GDPR. All other cookies, in particular for statistics and marketing, are set only with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you give via our cookie banner and can change or withdraw at any time via the “Cookie settings” link in the footer. For consent management we use Shopify’s cookie banner and privacy settings (provider see section 2).
5. Orders and customer account
When you place an order, we process your name, shipping and billing address, e-mail address, phone number where provided, the goods ordered, the payment method and any details you provide voluntarily during the ordering process. Processing serves the performance of the contract, in particular shipping, invoicing, accounting, returns and complaints (Art. 6 (1) (b) GDPR). For order processing and accounting we use the ERP system Odoo (Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium) as a processor. We store the data until all claims arising from the contract have been settled and the statutory commercial and tax retention periods (up to ten years, Section 257 German Commercial Code, Section 147 German Fiscal Code) have expired.
If you create a customer account, we store the data entered there until you delete the account. You can also order as a guest. To conclude a contract, your name, shipping address and e-mail address are required (Section 312i German Civil Code, Section 14 German VAT Act); without these you cannot order. No automated decision-making takes place.
6. Payment processing
Depending on the payment method chosen, we transmit the data required for payment (name, billing address, amount, e-mail address where applicable) to the respective payment service provider; you enter the payment details themselves (card number, account details) directly with the provider (Art. 6 (1) (b) GDPR):
- Shopify Payments (credit card, Apple Pay, Google Pay, Shop Pay): Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, as payment processor for Shopify.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg.
- Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For invoice or instalment purchases, Klarna carries out an identity and credit check; the legal basis is Art. 6 (1) (b) and (f) GDPR. Klarna’s privacy notice applies.
7. Shipping
For delivery we transmit your name, shipping address and – where you have consented – e-mail address and phone number for delivery notifications to our carriers DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, and FedEx Express Deutschland GmbH, Langer Kornweg 34 k, 65451 Kelsterbach, Germany (Art. 6 (1) (b) or (a) GDPR). We ship from our own warehouse; no external fulfilment provider is involved.
8. Contacting us
If you contact us via the contact form, e-mail or phone, we process your details to handle your enquiry and any follow-up questions (Art. 6 (1) (f) GDPR; for contract-related enquiries Art. 6 (1) (b) GDPR). For e-mail we use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. We delete enquiries no later than twelve months after the last communication, unless statutory retention obligations apply.
9. Newsletter
If you subscribe to our newsletter, we use your e-mail address to inform you about LACUEOR products, rituals and offers. Subscription uses a double opt-in procedure: you receive an e-mail with a confirmation link and are added to the list only after confirming. We log the subscription, confirmation and IP address to be able to prove your consent. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link in every newsletter or by writing to info@lacueor.com.
To send and analyse the newsletter (opens, clicks) we use Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, as a processor. Transfers to the USA are based on the EU-US Data Privacy Framework, of which Klaviyo is a member, and the EU standard contractual clauses. With your consent via the cookie banner, Klaviyo also records your activity in the shop (viewed products, cart) to send you relevant content.
10. Reviews
After an order, you can review products. For this we use Judge.me (Judge.me Ltd, 20–22 Wenlock Road, London N1 7GU, United Kingdom; an EU adequacy decision exists for the UK). Judge.me processes on our behalf your name, e-mail address, order and review text; reviews are published with first name and abbreviated surname. We send the review request by e-mail on the basis of Art. 6 (1) (f) GDPR (interest in genuine customer opinions); you may object at any time.
11. Instagram embed
On our website we show posts from our Instagram channel via the Instafeed app. The images are loaded from servers of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, which receives your IP address. The embed is loaded only with your consent via the cookie banner (Art. 6 (1) (a) GDPR).
12. Web analytics
Shopify provides us with anonymised statistics on the use of the shop (Shopify Analytics); the legal basis is Art. 6 (1) (f) GDPR.
With your consent (Art. 6 (1) (a) GDPR) we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the shop (page views, time on site, referrer, approximate location based on a truncated IP address). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. User data is retained by Google for 14 months. You can withdraw your consent at any time via the cookie settings.
13. Online marketing
With your consent (Art. 6 (1) (a) GDPR) we use the Meta Pixel and Conversions API of Meta Platforms Ireland Limited to measure the effectiveness of our advertising on Facebook and Instagram and to show you relevant ads. Usage data (pages viewed, purchases, hashed e-mail address) is transmitted to Meta, including to the USA (EU-US Data Privacy Framework). We and Meta are joint controllers for the collection and transmission; the agreement is available at https://www.facebook.com/legal/controller_addendum. Withdraw at any time via the cookie settings.
14. Fonts
The fonts used in the shop are loaded from Shopify servers; no connection is made to Google Fonts or other font providers.
15. Social media links
Links to Instagram and Facebook are plain links. You leave our shop only when you click them; we transmit no data to the platforms.
16. Recipients and international transfers
Your data is shared only with the service providers named in this policy, insofar as necessary for the performance of the contract, on the basis of your consent or to protect legitimate interests, and with authorities where we are legally obliged. Transfers to countries outside the EU/EEA take place only on the basis of an adequacy decision (Canada, United Kingdom, USA for companies certified under the Data Privacy Framework) or the EU standard contractual clauses.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent given at any time with effect for the future (Art. 7 (3) GDPR). Please contact info@lacueor.com.
Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6 (1) (f) GDPR (Art. 21 (1) GDPR). Where your data is processed for direct marketing, you may object at any time without giving reasons (Art. 21 (2) GDPR).
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.
18. Changes
We update this privacy policy when our data processing or the legal situation changes. The version published here applies.