Privacy policy

Last updated: 4 September 2026

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Jajoo GmbH
Kurfürstendamm 30
10719 Berlin, Germany
Represented by: Andreas Wezler
Phone: +49 160 1569299
Email: shop@jajoo.de
Commercial register: HRB 256964 B, Amtsgericht Charlottenburg (Berlin)
VAT ID: DE367164432

No data protection officer has been appointed, as the statutory requirements for an appointment are not met. Please direct data protection enquiries to shop@jajoo.de.

2. Overview

This privacy policy explains which personal data we process when you visit our online shop jajoo.de, place orders, or otherwise communicate with us, for which purposes, on which legal basis, and which rights you have. Personal data means any information relating to an identified or identifiable person (e.g. name, address, email address, IP address, order and usage data).

3. Legal Bases

We process personal data on the basis of Art. 6(1) GDPR, in particular: point (a) (consent, e.g. for marketing cookies and tracking pixels), point (b) (performance of a contract, e.g. order processing), point (c) (legal obligations, e.g. commercial and tax retention duties) and point (f) (legitimate interests, e.g. the secure and stable operation of the shop). The use of cookies and similar technologies on your device is additionally governed by Section 25 of the German TDDDG (formerly TTDSG): storage and read operations that are not technically necessary take place only with your consent.

4. Hosting and Shop System: Shopify

Our online shop runs on the e-commerce platform Shopify, provided by Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland ('Shopify'). Shopify processes on our behalf, among other things, order, contact, payment and usage data as well as IP addresses, and provides the technical infrastructure of the shop (Art. 6(1)(b) and (f) GDPR; data processing agreement pursuant to Art. 28 GDPR). Our shop data is stored in data centres in the European Union; transfers to Shopify Inc. (Canada) and affiliated companies in the USA cannot be excluded and are based on the adequacy decision for Canada and the EU Standard Contractual Clauses. More information: Shopify Privacy Policy.

The shop system also includes the payment service Shop Pay / the Shop app (Shopify), the search and filter function (Shopify Search & Discovery) and the chat service Shopify Inbox, if you actively use it. We also use Shopify Analytics, the platform's built-in statistics feature, for reach measurement; non-essential analytics run only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Shopify additionally uses certain shop data (e.g. fraud signals, aggregated usage patterns) across all Shopify stores to improve its services ('Shopify Network Intelligence'), under Shopify's own responsibility.

5. Cookies and Consent Management (Cookie Banner)

We use cookies and similar technologies (pixels, local storage, SDKs). Technically necessary cookies (e.g. cart, language settings, security and consent cookies) are used on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR. All non-essential cookies and tracking technologies — in particular the marketing, analytics and functional services listed in sections 7 to 10 — are only set or read after you have expressly consented via our cookie banner (provided by Shopify) (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can withdraw or adjust your consent at any time with effect for the future: via the 'Cookie settings' link in the footer of every page (which reopens the cookie banner) or by sending an informal message to shop@jajoo.de. Your choice is stored in a technically necessary cookie ('_tracking_consent').

6. Order Processing, Payment and Shipping

To process your order we process your order, contact, delivery and payment data (Art. 6(1)(b) GDPR). We use the following categories of service providers:

Payment providers: Depending on the payment method you choose, your payment data is transmitted to the respective payment provider (Art. 6(1)(b) GDPR): Shopify Payments (Shopify International Limited, Ireland) for credit and debit cards, Apple Pay, Google Pay, Shop Pay, Bancontact, EPS and iDEAL/Wero; PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg); Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden) for pay-later and instalment options. To decide which payment options to offer, Klarna carries out an identity and credit check that may involve credit agencies (Art. 6(1)(b) and (f) GDPR; Art. 22(2)(a) GDPR). If a Klarna payment option is declined, alternative payment methods are always available; you may request a review of the decision by a person (Art. 22(3) GDPR). More information: Klarna Privacy Policy.

Shipping providers and shipping software: For delivery we transmit your name, delivery address and — where required for delivery — your email address and phone number to our shipping partners, in particular DHL / Deutsche Post AG and DHL Express. For shipping labels, tracking and the synchronisation of tracking numbers we use Easyship, DHL Express Commerce and Synctrack (PayPal tracking); delivery-time estimates in the shop are provided by ArrivesBy (Art. 6(1)(b) GDPR).

Sales channels and marketplace integrations: Orders may reach us via the Shop app (Shopify), Facebook and Instagram Shops, Google & YouTube and Pinterest, and via connected marketplaces (e.g. OTTO, Etsy); for these integrations we use Shopify Marketplace Connect and M2E Cloud (OTTO Importer). In these cases we receive your order data from the respective channel, whose own privacy policy applies in addition. Via Shopify's 'Agentic' channel, third-party AI assistants may retrieve products and initiate orders on your behalf; we receive only the data required for the order.

7. Marketing and Analytics Pixels (only with consent)

We use the following services only if you have consented via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). These services process in particular pseudonymous identifiers (cookie IDs, advertising IDs), IP address, device and browser information, and event data (e.g. pages visited, products viewed, cart, purchases). Where data is transferred to the USA, the transfer is based on the applicable adequacy decision (EU-US Data Privacy Framework) and/or EU Standard Contractual Clauses. You can withdraw your consent at any time (see section 5).

Meta Pixel (Facebook and Instagram): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Measurement and optimisation of our ads on Facebook and Instagram, audience building (Custom Audiences) and conversion tracking. We are jointly responsible with Meta for the collection and transmission of event data (Art. 26 GDPR). More information: Meta Privacy Policy.

Google Ads, Google Tag / Google Analytics 4, Google Merchant Center and YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Conversion measurement and remarketing for Google advertising, web analytics (reach measurement, usage statistics) and product display via the Google Shopping network and the Google & YouTube sales channel. More information: Google Privacy Policy.

Pinterest Tag: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Measurement and optimisation of our advertising on Pinterest and conversion tracking. More information: Pinterest Privacy Policy.

8. Email Marketing and Newsletter

You can subscribe to our newsletter ("Jajoo Journal") via the sign-up form in our shop. The legal basis for sending it is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the unsubscribe link in every email or by an informal message to shop@jajoo.de.

We use the double opt-in procedure: after signing up you receive an email with a confirmation link, and only once you click it is the subscription active. To be able to demonstrate your consent (Art. 7(1) GDPR), we record your email address, the date and time of the sign-up and of the confirmation, and the form through which you subscribed (for example, a link from one of our social media posts). We do not record your IP address for this purpose.

The sign-up form, the confirmation email and the subscriber list are operated by Shopify (see section 4). For sending the newsletter and for personalised email marketing we use Klaviyo, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, which receives confirmed subscriptions from Shopify. Klaviyo analyses open and click rates of our emails to personalise content (Art. 6(1)(a) GDPR). Klaviyo website scripts. When you visit our website, scripts from Klaviyo are loaded so that sign-up forms and notices (e.g. "back in stock") can be displayed. In the process, your IP address is transmitted to Klaviyo to determine your approximate region, and a counter for displayed forms is stored locally in your browser (local storage / session storage, no cookies). The legal basis is our legitimate interest in providing these functions (Art. 6(1)(f) GDPR). Behavioural tracking — the __kla_id cookie and the linking of page views and product views to your profile — takes place only after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time via "Cookie settings" in the footer. Klaviyo Inc. (USA) is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. More information: Klaviyo Privacy Notice.

Transactional and notification emails (order confirmation, shipping, returns) are sent via Shopify (Art. 6(1)(b) GDPR).

9. Customer Reviews: Judge.me

We use Judge.me (Judge.me Ltd., City View House, 5 Union Street, London SW4 6JP, United Kingdom) to collect and display product reviews. Data processed includes name (or pseudonym), email address, order reference and review content. Legal bases are Art. 6(1)(b) and (f) GDPR (post-purchase review request in accordance with Section 7(3) German UWG or consent); an EU adequacy decision exists for the United Kingdom. The review widget in the shop processes usage data only after your consent via the cookie banner (Section 25(1) TDDDG). More information: Judge.me Privacy Policy.

10. Other Third-Party Services and Embedded Content

Functional widgets (only with consent): Instagram feed (Space Squirrel Ltd., United Kingdom; content from Meta Platforms Ireland Limited), loyalty programme 'Rewards' (Smile.io Inc., Kitchener, Canada — adequacy decision for Canada), wishlist (SE Wishlist Engine) and back-in-stock notifications (Kbite Back In Stock, DEVSQUAT SOLUTIONS, New Delhi, India — EU Standard Contractual Clauses). These widgets load scripts and content from the respective provider's servers and are loaded only after your consent via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). In the loyalty programme we process participants' account data, order history and points balances; for back-in-stock alerts, the email address or phone number you provide and the requested product (Art. 6(1)(b) GDPR).

Image delivery (Cloudinary): Some product images are delivered via Cloudinary Ltd. (United Kingdom; adequacy decision); your IP address is transmitted to Cloudinary in the process (Art. 6(1)(f) GDPR).

SEO structured data (Tapita): This function transmits only your IP address for technical delivery when called (Art. 6(1)(f) GDPR).

Fonts and videos: Fonts and videos are delivered from Shopify servers; no fonts or videos are loaded from third-party servers.

11. Customer Account, Contact and Chat

If you create a customer account, we process the data you provide to operate the account (Art. 6(1)(b) GDPR); the account can be deleted at any time. When you contact us by email, phone or contact form, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR).

Chat (Shopify Inbox): If you use the chat, we process your messages and — if provided — your email address in order to reply (Art. 6(1)(b) or (f) GDPR). Replies are given by our staff; no AI assistant is active.

12. Social Media Presence

We maintain profiles on Instagram, Facebook, TikTok, Pinterest, YouTube and LinkedIn. When you visit these profiles, the respective platform operator processes your data under its own responsibility; in some cases we are jointly responsible for page statistics (e.g. Facebook Page Insights, Art. 26 GDPR). The privacy notices of the respective platform apply in addition.

13. Retention Periods

We store personal data only for as long as necessary for the respective purpose:

• Order, invoice and payment data: 8 years (accounting records, Section 257 HGB) or 10 years (Section 147 AO) from the end of the respective calendar year;
• Customer account: until you delete it or request deletion; thereafter only the order data listed above remains;
• Contact enquiries (email, contact form, chat): 12 months after final handling;
• Newsletter data: until withdrawal; your email address then remains on a suppression list to document the withdrawal;
• Product reviews: for as long as the product is published, at most until you request deletion;
• Loyalty programme, wishlist, back-in-stock alerts: until you delete your customer account or until the notification has been sent;
• Consent cookie ('_tracking_consent'): 12 months; further cookie lifetimes are shown in the cookie banner under 'Manage preferences'.

14. Your Rights

You have the following rights vis-à-vis us regarding your personal data: right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. Where your data is processed for direct marketing, you may object to such processing at any time without giving reasons.

To exercise your rights, an informal message to shop@jajoo.de is sufficient.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de.

16. International Data Transfers

Where we transfer data to countries outside the EU/EEA (in particular the USA, Canada, the United Kingdom and India), this only takes place if an EU adequacy decision exists (e.g. the EU-US Data Privacy Framework for certified US providers, Canada, the United Kingdom), EU Standard Contractual Clauses have been agreed, or you have given your explicit consent (Art. 44 et seq. GDPR). To our knowledge, Klaviyo, Inc. is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply to non-certified recipients.

17. Changes to this Privacy Policy

We update this privacy policy whenever changes to our data processing require it. The version published here applies.