Privacy policy

Last updated: 19 August 2026

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Jajoo GmbH
Kurfürstendamm 30
10719 Berlin, Germany
Represented by: Andreas Wezler
Phone: +49 160 1569299
Email: shop@jajoo.de
Commercial register: HRB 256964 B, Amtsgericht Charlottenburg (Berlin)
VAT ID: DE367164432

2. Overview

This privacy policy explains which personal data we process when you visit our online shop jajoo.de, place orders, or otherwise communicate with us, for which purposes, on which legal basis, and which rights you have. Personal data means any information relating to an identified or identifiable person (e.g. name, address, email address, IP address, order and usage data).

3. Legal Bases

We process personal data on the basis of Art. 6(1) GDPR, in particular: point (a) (consent, e.g. for marketing cookies and tracking pixels), point (b) (performance of a contract, e.g. order processing), point (c) (legal obligations, e.g. commercial and tax retention duties) and point (f) (legitimate interests, e.g. the secure and stable operation of the shop). The use of cookies and similar technologies on your device is additionally governed by Section 25 of the German TDDDG (formerly TTDSG): storage and read operations that are not technically necessary take place only with your consent.

4. Hosting and Shop System: Shopify

Our online shop runs on the e-commerce platform Shopify, provided by Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland ('Shopify'). Shopify processes on our behalf, among other things, order, contact, payment and usage data as well as IP addresses, and provides the technical infrastructure of the shop (Art. 6(1)(b) and (f) GDPR; data processing agreement pursuant to Art. 28 GDPR). Our shop data is stored in data centres in the European Union; transfers to Shopify Inc. (Canada) and affiliated companies in the USA cannot be excluded and are based on the adequacy decision for Canada and the EU Standard Contractual Clauses. More information: Shopify Privacy Policy.

The shop system also includes the payment service Shop Pay / the Shop app (Shopify) and the chat service Shopify Inbox, if you actively use it. We also use Shopify Analytics, the platform's built-in statistics feature, for reach measurement; non-essential analytics run only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

5. Cookies and Consent Management (Cookie Banner)

We use cookies and similar technologies (pixels, local storage, SDKs). Technically necessary cookies (e.g. cart, language settings, security and consent cookies) are used on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR. All non-essential cookies and tracking technologies — in particular the marketing and analytics services listed in sections 7 and 8 — are only set or read after you have expressly consented via our cookie banner (provided by Shopify) (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can withdraw or adjust your consent at any time with effect for the future: via the 'Manage preferences' button in the cookie banner, via the 'Your Privacy Choices' or 'Cookie settings' link in the footer, or by sending an informal message to shop@jajoo.de.

6. Order Processing, Payment and Shipping

To process your order we process your order, contact, delivery and payment data (Art. 6(1)(b) GDPR). We use the following categories of service providers:

Payment providers: Depending on the payment method you choose, your payment data is transmitted to the respective payment provider, in particular Shopify Payments (Shopify International Limited, Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg). Legal basis: Art. 6(1)(b) GDPR.

Shipping providers: For delivery we transmit your name, delivery address and — where required for delivery — your email address to our shipping partners, in particular DHL / Deutsche Post AG (Art. 6(1)(b) GDPR).

Marketplace integrations: If you order from us via connected marketplaces (e.g. OTTO, Etsy), we receive your order data from the respective marketplace; its own privacy policy applies in addition.

7. Marketing and Analytics Pixels (only with consent)

We use the following services only if you have consented via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). These services process in particular pseudonymous identifiers (cookie IDs, advertising IDs), IP address, device and browser information, and event data (e.g. pages visited, products viewed, cart, purchases). Where data is transferred to the USA, the transfer is based on the applicable adequacy decision (EU-US Data Privacy Framework) and/or EU Standard Contractual Clauses. You can withdraw your consent at any time (see section 5).

Meta Pixel (Facebook and Instagram): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Measurement and optimisation of our ads on Facebook and Instagram, audience building (Custom Audiences) and conversion tracking. We are jointly responsible with Meta for the collection and transmission of event data (Art. 26 GDPR). More information: Meta Privacy Policy.

Google Ads, Google Tag / Google Analytics 4, Google Merchant Center and YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Conversion measurement and remarketing for Google advertising, web analytics (reach measurement, usage statistics) and product display via the Google Shopping network and the Google & YouTube sales channel. More information: Google Privacy Policy.

TikTok Pixel: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, Ireland. Measurement and optimisation of our advertising on TikTok and conversion tracking. More information: TikTok Privacy Policy.

Pinterest Tag: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Measurement and optimisation of our advertising on Pinterest and conversion tracking. More information: Pinterest Privacy Policy.

Triple Whale (analytics and ad attribution): Triple Whale Inc., USA. Aggregation and analysis of shop, marketing and order data to measure the performance of our advertising campaigns; this involves processing IP address, device information and event data. More information: Triple Whale Privacy Policy.

8. Email Marketing and Onsite Tracking: Klaviyo

For sending our newsletter and for personalised email marketing we use Klaviyo, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Newsletter sign-up uses the double opt-in procedure; the legal basis for sending is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every email. With your consent, Klaviyo may also analyse usage behaviour on our website and in our emails (open and click rates, pages visited, cart) to personalise content (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. More information: Klaviyo Privacy Notice.

9. Customer Reviews: Judge.me

We use Judge.me (Judge.me Ltd., City View House, 5 Union Street, London SW4 6JP, United Kingdom) to collect and display product reviews. Data processed includes name (or pseudonym), email address, order reference and review content. Legal bases are Art. 6(1)(b) and (f) GDPR (post-purchase review request in accordance with Section 7(3) German UWG or consent); an EU adequacy decision exists for the United Kingdom. More information: Judge.me Privacy Policy.

10. Other Third-Party Services and Embedded Content

Instagram feed (Square Instagram Feed): To display our Instagram feed in the shop, a widget is loaded that retrieves content via the app provider's servers and/or Instagram (Meta Platforms Ireland Limited). Your IP address is transmitted in the process (Art. 6(1)(a) or (f) GDPR).

Video embedding (Mux): Videos on our website are delivered via Mux, Inc. (USA). When playing a video, your IP address is transmitted to Mux (Art. 6(1)(f) GDPR — technically required delivery of video content).

Loyalty programme ('Rewards', Smile.io): We use Smile.io (Smile.io Inc., Kitchener, Canada — adequacy decision for Canada) for our rewards programme. Account data, order history and points balances of programme participants are processed (Art. 6(1)(b) GDPR for participants; the widget embedding otherwise Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Shop features and notification widgets: Our shop embeds functional widgets (e.g. product badges) that are loaded from the respective provider's servers and may process your IP address and pseudonymous usage data. Where such widgets are not technically necessary, we use them only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Fonts and script libraries (Google Fonts, CDN services): For consistent presentation, fonts and script libraries are partly loaded from third-party servers (Google Fonts by Google Ireland Limited; content delivery networks such as cdnjs/Cloudflare and the jQuery CDN). Your IP address is transmitted to the respective provider (Art. 6(1)(f) GDPR). We are working on embedding these resources locally.

11. Customer Account, Contact and Communication

If you create a customer account, we process the data you provide to operate the account (Art. 6(1)(b) GDPR); the account can be deleted at any time. When you contact us by email, phone or contact form, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR).

12. Social Media Presence

We maintain profiles on Instagram, Facebook, TikTok, Pinterest and YouTube. When you visit these profiles, the respective platform operator processes your data under its own responsibility; in some cases we are jointly responsible for page statistics (e.g. Facebook Page Insights, Art. 26 GDPR). The privacy notices of the respective platform apply in addition.

13. Retention Periods

We store personal data only for as long as necessary for the respective purposes. Order and invoice data is retained in accordance with commercial and tax law for 8 or 10 years (Section 257 HGB, Section 147 AO). Consent-based processing ends when you withdraw consent; cookie lifetimes can be found in the cookie banner settings.

14. Your Rights

You have the following rights vis-à-vis us regarding your personal data: right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. Where your data is processed for direct marketing, you may object to such processing at any time without giving reasons.

To exercise your rights, an informal message to shop@jajoo.de is sufficient.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de.

16. International Data Transfers

Where we transfer data to countries outside the EU/EEA (in particular the USA, Canada and the United Kingdom), this only takes place if an EU adequacy decision exists (e.g. the EU-US Data Privacy Framework for certified US providers, Canada, the United Kingdom), EU Standard Contractual Clauses have been agreed, or you have given your explicit consent (Art. 44 et seq. GDPR).

17. Changes to this Privacy Policy

We update this privacy policy whenever changes to our data processing require it. The version published here applies.