Privacy Policy

Effective Date: [01.07.2026]

Welcome to machamachenka, owned and operated by Macha Romaniuk . This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site, in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

By using the Site, you agree to the terms of this Privacy Policy. If you do not agree, please do not access or use the Site.

1. Information We Collect

Personal Data

We may collect personally identifiable information ("Personal Data") that you voluntarily provide to us when you:

  • Register for an account

  • Subscribe to our newsletter

  • Fill out a contact form

  • Make a purchase

  • Participate in surveys or promotions

The Personal Data we collect may include:

  • Name

  • Email address

  • Phone number

  • Billing and shipping addresses

  • Payment information (processed securely via third-party payment processors)

Automatically Collected Data

When you visit our Site, we automatically collect certain information about your device and usage, such as:

  • IP address

  • Browser type and version

  • Operating system

  • Referring URLs

  • Pages visited and time spent on the Site

  • Device identifiers

This data is collected using cookies and similar technologies, as explained in our Cookie Policy.

2. Legal Basis for Processing

Under Article 6 of the GDPR, we process your Personal Data only if we have a lawful basis, such as:

  • Consent (Art. 6(1)(a) GDPR): For newsletter sign-ups, non-essential cookies, and marketing communications.

  • Contractual Necessity (Art. 6(1)(b) GDPR): To fulfill orders, provide services, or respond to inquiries.

  • Legitimate Interest (Art. 6(1)(f) GDPR): For analytics, security, and fraud prevention, unless overridden by your rights.

  • Legal Obligation (Art. 6(1)(c) GDPR): To comply with German or EU laws (e.g., tax or accounting requirements).

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain our Site

  • Improve, personalize, and expand our Site

  • Understand and analyze how you use our Site

  • Develop new products, services, features, and functionality

  • Communicate with you for customer service, updates, and marketing (where consented)

  • Process transactions and manage orders

  • Prevent fraud and ensure security

  • Comply with legal obligations

4. How We Share Your Information

We may share your information in the following situations:

With Service Providers

We share Personal Data with third-party vendors, service providers, or agents who perform services for us, such as:

  • Payment processors (e.g., Stripe, PayPal)

  • Hosting providers (e.g., Squarespace)

  • Analytics tools (e.g., Google Analytics)

  • Email marketing services (e.g., Mailchimp)

These providers act as data processors under GDPR and are contractually obligated to protect your data.

For Business Transfers

We may share or transfer your Personal Data in connection with a merger, sale of assets, or acquisition.

For Legal Reasons

We may disclose your Personal Data if required by law or to protect our rights, property, or safety.

5. Cookies and Tracking Technologies

Cookie Policy

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small files stored on your device that help us analyze usage and improve functionality.

Types of Cookies We Use:

  • Essential Cookies: Necessary for the Site to function (e.g., session cookies). No consent is required for these.

  • Analytical Cookies: Help us understand how you interact with the Site (e.g., Google Analytics). Requires your consent.

  • Marketing Cookies: Used to track visitors and display relevant ads. Requires your consent.

Cookie Consent

Under GDPR and the ePrivacy Directive, we obtain your explicit consent before placing non-essential cookies. You can:

  • Accept or reject cookies via our cookie banner.

  • Withdraw consent at any time by [link to cookie settings].

For more details, see our Cookie Consent Tool.

6. Data Retention

We retain your Personal Data only for as long as necessary for the purposes outlined in this Privacy Policy or as required by law. Specific retention periods include:

  • Account Data: Until you request deletion.

  • Order Data: 10 years (for tax/legal compliance in Germany).

  • Analytics Data: 26 months (default for Google Analytics).

  • Cookie Data: As specified in our Cookie Policy.

7. Your Privacy Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights regarding your Personal Data:

  • Right to Access (Art. 15 GDPR): Request a copy of your Personal Data.

  • Right to Rectification (Art. 16 GDPR): Request corrections to inaccurate or incomplete data.

  • Right to Erasure (Art. 17 GDPR): Request deletion of your data ("Right to be Forgotten").

  • Right to Restrict Processing (Art. 18 GDPR): Request to limit how we use your data.

  • Right to Data Portability (Art. 20 GDPR): Request to transfer your data to another service.

  • Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests (e.g., direct marketing).

  • Right to Withdraw Consent: Revoke consent for processing (e.g., marketing emails).

To exercise any of these rights, contact us at [Your Contact Email]. We will respond within 30 days, as required by GDPR.

8. Data Protection Officer (DPO)

For questions about data protection, you may contact:
[Your Name or DPO Name]
[Your Email]
[Your Address (if applicable)]

(Note: Appointing a DPO is mandatory for public authorities or organizations processing large-scale sensitive data. For small businesses, this section is optional but recommended.)

9. International Data Transfers

Your Personal Data may be transferred to and processed in countries outside the EU/EEA, such as the United States, where our service providers (e.g., Squarespace, Google) are based. We ensure such transfers are legally compliant by:

  • Using Standard Contractual Clauses (SCCs) approved by the European Commission.

  • Relying on certified providers under the EU-US Data Privacy Framework (where applicable).

For more details, see:

10. Security of Your Information

We implement administrative, technical, and physical security measures to protect your Personal Data. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

11. Children’s Privacy

Our Site is not intended for use by children under 16 (or 13 in some jurisdictions). We do not knowingly collect Personal Data from children under this age. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us immediately.

12. Links to Other Websites

Our Site may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and updating the Effective Date at the top. You are advised to review this Privacy Policy periodically.

14. Right to Lodge a Complaint

If you believe we have violated your privacy rights under GDPR, you have the right to lodge a complaint with a supervisory authority, such as:

The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
📍 Husarenstraße 30, 53117 Bonn, Germany
🌐 www.bfdi.bund.de
📧 poststelle@bfdi.bund.de

15. Squarespace as a Data Processor

Our Site is hosted by Squarespace, Inc., a US-based company. Squarespace acts as a data processor for us and complies with GDPR via Standard Contractual Clauses (SCCs). For details, see Squarespace’s GDPR page.

16. Contact Us

For questions or requests regarding this Privacy Policy or your Personal Data, please contact us at:

Macha Machenka
choukawaiiberlin@gmail.com