Privacy policy

Last updated: 18 June 2026

Jyoti - Fair Works operates this shop and website, including all related information, content, features, tools, products and services, to provide you as a customer with an individual shopping experience (the “Services”). Jyoti - Fair Works is built on Shopify, which enables us to provide you with the Services.

This Privacy Policy describes how we collect, use or share personal data when you visit, use or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our terms and conditions and this Privacy Policy, this Privacy Policy takes precedence with regard to the collection, processing and sharing of your personal data.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you confirm that you have read this Privacy Policy and agree to the collection, use and sharing of your data as described herein.

What personal data do we collect or process?

When we use the term “personal data”, we refer to information that identifies you or another person, or can be directly associated with you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal data:

Contact data including name, postal address, billing address, delivery address, phone number and email address
Financial data including payment card information, transaction details, payment method and payment confirmation
Account information including username, password and account settings
Transaction information including items you view, add to your cart, purchase, return or cancel, as well as your past transactions
Communications with us including information you provide when contacting us, for example when submitting a support request
Device information including information about your device, browser or network connection, as well as your IP address
Usage information including information about your interaction with the Services

Legal bases for processing

We process your personal data on the basis of the following legal grounds pursuant to Art. 6 GDPR:

Art. 6(1)(b) GDPR – Performance of a contract: to process your orders, payments, returns and other contractual services
Art. 6(1)(c) GDPR – Legal obligation: to comply with legal requirements, e.g. statutory retention obligations or the obligation to provide an electronic means of withdrawal
Art. 6(1)(f) GDPR – Legitimate interests: for fraud prevention, IT security and improvement of our Services
Art. 6(1)(a) GDPR – Consent: for marketing and advertising communications by email or SMS, where you have given your consent

Sources of personal data

We may collect personal data from the following sources:

Directly from you – when you create an account, use the Services, communicate with us or otherwise provide us with your data
Automatically via the Services – from your device, through cookies and similar technologies
From our service providers – when we engage third parties to enable certain technologies and they process your data on our behalf

How do we use your personal data?

Depending on how you interact with us or which Services you use, we may use your personal data for the following purposes:

Providing and improving the Services: This includes fulfilling our contract with you, processing your payments, executing your orders, facilitating returns and exchanges, and creating an individual shopping experience for you.

Marketing and advertising: We use your data to send you marketing and advertising communications by email or SMS – provided you have given your consent. You can withdraw your consent at any time.

Security and fraud prevention: We use your data to authenticate your account, provide a secure shopping experience, and detect possible fraudulent or malicious activities.

Communication with you: We use your data to provide customer support and respond to your enquiries promptly.

Legal reasons: We use your data to comply with applicable law or respond to lawful legal proceedings.

How do we share personal data?

Under certain circumstances, we may share your personal data with third parties for legitimate purposes:

With Shopify and other service providers acting on our behalf (e.g. payment processing, shipping, cloud storage)
With business and marketing partners for marketing services, where you have given your consent
In connection with legal obligations or to enforce our terms and conditions

Cookies

Our website uses cookies – small text files stored on your device. We distinguish between technically necessary cookies, which do not require your consent, and cookies used for analytics and marketing purposes, for which we obtain your consent via our cookie banner. You can withdraw or adjust your consent at any time through the cookie banner.

The following cookies are active:

_shopify_essential – set by Shopify; contains information necessary for the operation of the store such as session details, checkout information and security data. Duration: 1 year.

cart_currency – set by Shopify; stores your preferred currency for correct transaction display. Duration: 14 days.

localization – set by Shopify; stores your language and region preference. Duration: 1 year.

csrftoken – protects the website against cross-site request forgery attacks. Duration: 1 year.

_ks_scriptVersionChecked – set by Klaviyo; technical cookie for version checking of the embedded Klaviyo script. Duration: 1 day.

In addition, Klaviyo uses a script that tracks the behaviour of website visitors (known as onsite tracking). This only takes place after you have given your explicit consent via our cookie banner. Without your consent, this tracking will not be activated.

Electronic withdrawal form (REVOQ)

We use the app REVOQ (provider: Jonas Busch, sole trader, hello@buschbytes.com) on our website to provide an electronic withdrawal form in accordance with EU Directive 2023/2673.

When you use the withdrawal form, the data you enter (name, email address, order details) will be processed for the purpose of handling your withdrawal request. REVOQ will also send you an automatic confirmation of receipt by email.

REVOQ processes this data on our behalf as a data processor pursuant to Art. 28 GDPR. A Data Processing Agreement (DPA) has been concluded accordingly. REVOQ’s infrastructure is hosted entirely within the EU (Germany and the Netherlands).

The legal basis for this processing is Art. 6(1)(c) GDPR (compliance with a legal obligation), in conjunction with the statutory requirement to provide an electronic means of withdrawal.

For more information on data protection at REVOQ, please visit: consumer-withdrawal.eu/privacy

Email marketing (Klaviyo)

We use the service Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA) for our email and SMS marketing.

When you subscribe to our newsletter or consent to receiving marketing communications, your email address and, where applicable, your name and purchase history will be transmitted to and processed by Klaviyo. Klaviyo enables us to send you personalised emails and SMS messages and to analyse user behaviour in our emails.

We also use Klaviyo’s onsite tracking feature. This records the behaviour of all website visitors – including anonymous visitors – and, once a person becomes identifiable (e.g. through a purchase or newsletter sign-up), links this data to their profile. This enables us, for example, to send reminders when a shopping cart or product page has been abandoned. Onsite tracking is only activated after you have given your consent via our cookie banner.

The legal basis for this processing is Art. 6(1)(a) GDPR (consent) – both for email marketing communications and for onsite tracking. You may withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us directly.

As Klaviyo is a US-based provider, your data will be transferred to the United States. This transfer is carried out on the basis of the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Klaviyo is also certified under the EU-US Data Privacy Framework.

For more information on data protection at Klaviyo, please visit: klaviyo.com/legal/privacy-notice

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal data about your access to and use of the Services in order to provide and improve them. Data you submit through the Services may be shared with Shopify and third parties who may be located in countries other than your country of residence.

For more information: privacy.shopify.com

Third-party websites and links

The Services may contain links to websites or online platforms operated by third parties. If you follow links to websites that are not affiliated with or controlled by us, you should review their privacy and security policies. We accept no responsibility for the privacy or security of such websites.

Children’s data

The Services are not intended for use by children, and we do not knowingly collect personal data from persons under the age of 16. If you are the parent or guardian of a child who has provided us with their data, you may contact us using the details below to request deletion of that data.

Security and retention of your data

We take appropriate technical and organisational measures to protect your personal data. Please note, however, that no security measures are perfect, and we therefore cannot guarantee absolute security.

How long we retain your personal data depends on various factors – including whether we need the data to manage your account, provide our Services, comply with legal obligations or resolve disputes.

Your rights

Depending on where you live, you may have the following rights regarding your personal data:

Right of access – you may request to see the data we hold about you
Right to erasure – you may request deletion of your data
Right to rectification – you may request correction of inaccurate data
Right to data portability – you may receive a copy of your data
Right to object and to restriction of processing – you may request that we stop or restrict processing for certain purposes
Withdrawal of consent – where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal

You may exercise these rights by contacting us using the details below.

Complaints

If you have complaints about how we process your personal data, please contact us in the first instance. You also have the right to lodge a complaint with the competent data protection supervisory authority. In Germany, this is the Federal Commissioner for Data Protection and Freedom of Information (BfDI) or the relevant state data protection authority.

International data transfers

We may process your personal data outside the country in which you reside. Where we transfer your data outside the European Economic Area, we rely on recognised transfer mechanisms such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. We will publish the revised version on this website and update the “Last updated” date accordingly.

Contact

If you have questions about our privacy practices or this Privacy Policy, or wish to exercise any of your rights, please contact us:

Jyoti - Fair Works

Oderberger Straße 42, 10435 Berlin, Germany

Phone: +49 160 4600352

Email: kontakt@jyoti-fairworks.org

For the purposes of applicable data protection law, we are the controller of your personal data.