Privacy policy

HIYARA · PRIVACY & CARE

Last updated: 26 October 2026

Who is responsible for your personal data?

This website and the Hiyara online store are operated by:

Marko Šimunić, trading as HIYARA
Peiner Straße 108
38176 Wendeburg
Germany

Email: hello@wearhiyara.com
Website: https://wearhiyara.com

Marko Šimunić is the controller responsible for the personal data processed for Hiyara’s own business purposes. Shopify and payment providers may also act as independent controllers for certain processing, as explained below.

This policy explains how we process personal data when you browse our website, join our newsletter, purchase a piece, submit a withdrawal or return request, or contact us. Browsing our website does not, by itself, constitute consent to optional tracking or marketing.

Personal data we process and where it comes from

Depending on your interaction with Hiyara, we process:

Contact and delivery details, such as your name, email address, telephone number, billing address and shipping address.
Order and transaction information, such as purchased items, payment status, delivery details, withdrawal declarations, returns, refunds and correspondence about your order.
Payment-related information supplied through your selected payment service. Payment providers handle the payment credentials needed for their services; we receive the transaction information needed to manage your purchase and refund.
Account details and preferences, if you use customer-account features.
Messages and other information you choose to provide when contacting us or submitting a request.
Technical information, such as IP address, browser and device information, access times and security-related records.
Browsing and interaction information, including viewed products and cart activity, depending on the features used and your privacy choices.
Newsletter subscription information, including your email address, subscription status and available records of signup, confirmation and withdrawal of consent.

We obtain data directly from you, through the operation of our website, and from service providers such as Shopify, payment providers and delivery providers where necessary for their services. Section 17 explains processing through our online withdrawal function.

Why we process data and our legal bases

Website operation and security

We process necessary technical information to deliver the website, maintain its reliability, prevent misuse and investigate security incidents. Our legal basis is Article 6(1)(f) GDPR. Our legitimate interests are operating a secure, reliable website and protecting our customers and business.

Orders, payment, delivery and returns

We process the information necessary to take steps at your request before a purchase and to fulfil your purchase contract, including payment, delivery, order communications, returns and refunds. Our legal basis is Article 6(1)(b) GDPR. Where processing is required by tax, accounting or consumer-protection law, Article 6(1)(c) GDPR also applies.

Statutory withdrawal requests

We process withdrawal declarations and send the required acknowledgements to meet our consumer-law obligations under Article 6(1)(c) GDPR. Processing needed to arrange a return and reimburse your purchase is also based on Article 6(1)(b) GDPR. Necessary evidence for legal claims may be retained under Article 6(1)(f) GDPR; our legitimate interest is establishing, exercising or defending our legal rights. Further details about our online withdrawal function appear in section 17.

Customer enquiries

For enquiries about a potential or existing purchase, our legal basis is Article 6(1)(b) GDPR. For other enquiries, we rely on Article 6(1)(f) GDPR; our legitimate interest is responding to messages and managing business communications.

Customer accounts

If you use customer-account features, we process the necessary account information to provide those features under Article 6(1)(b) GDPR.

Newsletter and promotional emails

We send our newsletter and promotional emails on the basis of your consent under Article 6(1)(a) GDPR and the applicable rules on electronic marketing, including Section 7 UWG.

Optional analytics, personalisation and advertising

Where optional tracking or related personal-data processing requires consent, our legal basis is Article 6(1)(a) GDPR. The rules on storage and access on your device are explained in section 5. Newsletter consent and cookie consent are separate choices.

Legal compliance and legal claims

We process and retain information needed to meet legal obligations under Article 6(1)(c) GDPR. Where necessary to establish, exercise or defend legal claims, we rely on Article 6(1)(f) GDPR; our legitimate interest is protecting our legal rights.

Newsletter signup and withdrawal of consent

Our newsletter includes Hiyara launch news, product updates and offers. Providing your email address for this purpose is voluntary and is not required to purchase from us.

For new newsletter signups through our website, we use double opt-in: you submit your email address and receive an email asking you to confirm your subscription. The promotional welcome email follows confirmation.

We use Shopify’s email-marketing services to manage subscriptions and send emails. We retain available subscription and confirmation records to demonstrate consent. The legal basis for retaining necessary evidence of consent is Article 6(1)(c), together with Article 7(1) GDPR. Necessary records for the defence of legal claims may also be retained under Article 6(1)(f) GDPR.

You can withdraw your consent at any time through the unsubscribe link in our marketing emails or by contacting hello@wearhiyara.com. Withdrawal does not affect processing carried out lawfully before withdrawal. Necessary order, payment or service messages are separate from marketing and may still be sent.

Cookies and similar technologies

Our website uses cookies and similar technologies for essential functions and, depending on your choices, optional analytics, personalisation and marketing.

Storage of or access to information on your device that is strictly necessary to provide a digital service you expressly request is based on Section 25(2) TDDDG. Other storage or access requiring consent is based on Section 25(1) TDDDG. Any associated processing of personal data also requires an appropriate GDPR legal basis, as described in section 3.

We use Shopify’s cookie-consent tools to present privacy choices in the regions configured for our store. The banner and preference panel describe the available categories. Where consent is required, optional technologies must not be activated before consent.

You can decline optional categories or change your choices through the cookie-preference controls provided on the website. You may also contact us for help withdrawing consent. Browser settings can delete or block cookies, although blocking essential cookies may affect website functions. Deleting cookies alone does not necessarily withdraw an existing consent record or your newsletter subscription.

Shopify hosting and Shopify Network Intelligence

Hiyara is hosted on Shopify. Shopify processes information about visits, transactions and use of our store to provide hosting, checkout, store administration, security and other services. For processing on our behalf, Shopify acts as a processor under its data-processing terms. For certain services and purposes, Shopify acts as an independent controller.

Shopify Network Intelligence is enabled for our store. It allows Shopify to use information from interactions with Hiyara together with information from interactions with other merchants and Shopify to provide enhanced services. These can include personalisation, analytics, fraud prevention and more relevant advertising.

Information about your activity may be shared with Shopify and its service providers, including recipients in other countries. Other merchants do not receive access to Hiyara’s identifiable customer records merely because Network Intelligence is enabled.

Where required, processing for optional tracking and personalised advertising is subject to your consent. Shopify describes how its integrated privacy tools communicate consent and opt-out choices to Network Intelligence. For processing for which Shopify is an independent controller, Shopify explains its purposes and legal bases in its own privacy notices.

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers

Shopify Privacy Portal, including requests to withdraw consent, object or exercise other rights regarding Shopify’s own processing:
https://privacy.shopify.com/en

Shopify Data Processing Addendum:
https://www.shopify.com/legal/dpa

Payments

We use Shopify Payments and PayPal for payment processing. Our checkout also supports accelerated checkout, digital wallets and local payment methods. The options available to you depend on your country, currency, device and the payment provider’s eligibility requirements.

Information processed and legal bases

Depending on the payment method, information processed may include your name, contact details, billing and shipping addresses, order reference, purchased items, amount, currency, payment authorisation, transaction identifiers, payment status and technical information used for authentication and security. Payment credentials are handled by the relevant payment services. We receive the transaction details needed to manage your purchase, payment and any refund.

Our legal basis for processing necessary to arrange and fulfil your purchase is Article 6(1)(b) GDPR. Processing required by tax, accounting or other legal obligations is based on Article 6(1)(c) GDPR. Necessary fraud prevention may be based on Article 6(1)(f) GDPR; our legitimate interest is preventing unauthorised payments and financial loss.

Payment providers, wallet providers, banks and payment networks may process information as independent controllers for their own services, security checks and legal obligations. Their privacy notices explain their own purposes, legal bases, recipients, retention periods and international transfers. Information about Hiyara’s international transfers appears in section 9.

Shopify Payments, cards and Shop Pay

Shopify Payments supports our card payments, including the card networks available at checkout. Shopify and the payment-processing partners, banks and card networks involved process the information needed to authenticate, authorise, settle and, where necessary, refund transactions.

We also offer Shop Pay, Shopify’s accelerated checkout service. If you use Shop Pay, Shopify processes the contact, delivery, payment and transaction information associated with that service. Information saved with Shop Pay is governed by Shopify’s applicable terms and privacy notices.

Further information:
Shopify Consumer Privacy Policy

Apple Pay

If you use Apple Pay, Apple’s relevant service entity, your card issuer and the payment-processing parties handle information necessary to authenticate and complete the payment. Apple Pay provides the payment information and any contact or delivery details you authorise for checkout. Your actual payment-card number is not shared with Hiyara through Apple Pay.

Further information:
Apple Pay & Privacy

Google Pay

If you use Google Pay, Google and the relevant payment-processing parties process payment, transaction and technical information to provide the service and prevent fraud. Information needed to complete your order is shared through the payment flow. For consumers in the European Economic Area, Google’s Payments Privacy Notice identifies Google Ireland Limited as the controller for the relevant consumer payment processing.

Further information:
Google Payments Privacy Notice

Klarna

We offer Klarna payment options through our checkout. To make these options available and process a purchase, checkout may transmit relevant contact and order information to Klarna, including your name, email address, billing and shipping details, order items and transaction amount. Klarna uses this information to assess the payment options available to you and administer its payment service.

Klarna processes information under its own responsibility as a controller. Depending on the payment option, its assessment may involve identity, fraud and creditworthiness checks, including automated approval decisions. These checks may affect whether a particular Klarna payment option is offered or approved. Klarna’s privacy information explains its processing and the rights available to you regarding these assessments.

Further information:
Klarna Privacy Information

PayPal

If you select PayPal, the information needed to process your purchase is transmitted to PayPal. PayPal processes payment and transaction information and may carry out identity, fraud and risk checks under its own responsibility. Additional checks may apply to particular PayPal payment or financing options.

Further information:
PayPal Privacy Statement

Local payment methods

Depending on your location and checkout eligibility, local payment options include Bancontact, BLIK, EPS, MB WAY and MobilePay through Shopify Payments. When you use one of these methods, the relevant payment-method operator, your participating bank or wallet provider and the payment processor exchange the transaction and authentication information needed to complete the payment. Their own privacy notices also apply to their processing.

The payment methods shown at checkout are the options available for your particular transaction. The availability of a method does not mean that every payment provider receives all of your order information.

Other recipients of personal data

Where necessary for the purposes described above, recipients may include:

Delivery and shipping providers, receiving the details needed to deliver your parcel.
Email, communication, IT and technical-support providers used to operate our business.
Our online withdrawal service provider, Revoq, and the necessary service providers supporting that function, as explained in section 17.
Professional advisers, such as accountants and legal advisers, where needed for their services.
Authorities, courts or other recipients where disclosure is required by law or necessary to protect legal rights.

Where providers process personal data on our behalf, we use data-processing agreements where required by Article 28 GDPR. Independent controllers are responsible for their own processing. We do not give every installed application access to all customer information; access depends on the application’s actual permissions and purpose.

International transfers

Some providers, including Shopify, payment providers and providers supporting our withdrawal function, operate internationally. Personal data may therefore be processed outside the European Economic Area, including in Canada and the United States. European hosting does not necessarily exclude access or processing from other countries.

For transfers subject to GDPR restrictions, the applicable safeguards may include an adequacy decision under Article 45 GDPR or standard contractual clauses under Article 46 GDPR, together with supplementary measures where necessary. An adequacy decision applies only within its scope; not every recipient in a country is automatically covered.

You can contact us for information about safeguards relevant to your data and how to obtain a copy, subject to necessary protection of confidential information. Shopify’s privacy notices and data-processing terms provide further information about its transfers. Information about Revoq’s supporting providers appears in section 17.

How long we keep personal data

We retain personal data for as long as necessary for the purpose for which it was collected, unless legal obligations or legal claims require longer retention.

Order, payment and accounting records are retained for the applicable German tax and commercial-law retention periods. The period depends on the record type and may be extended by legal proceedings or other statutory requirements.
Customer enquiries are retained for as long as needed to resolve the enquiry and any related contractual, statutory or legal-claim requirements.
Withdrawal declarations, acknowledgements and related correspondence are retained to handle the withdrawal, return and refund, comply with applicable recordkeeping obligations and preserve necessary evidence for legal claims. The period depends on the record’s legal classification, the applicable limitation period and whether a dispute remains unresolved. Copies in our email and order records may therefore be retained separately from records in the withdrawal app.
Newsletter subscription data is used until you unsubscribe or we discontinue the newsletter. Necessary consent records and a minimal suppression record may be retained longer to demonstrate compliance and prevent further marketing after an opt-out.
Technical and security records are retained for the period necessary to operate the service and investigate relevant incidents.
Cookie and similar-technology lifetimes vary by technology and provider. Where available, further details are supplied through the consent controls and provider information.

We delete or anonymise data when it is no longer needed and there is no lawful reason to retain it.

Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

Access your personal data under Article 15 GDPR.
Have inaccurate data corrected under Article 16 GDPR.
Request erasure under Article 17 GDPR.
Request restriction of processing under Article 18 GDPR.
Receive eligible data in a portable format under Article 20 GDPR.
Object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation, under Article 21 GDPR.
Object at any time to processing for direct marketing, including related profiling. We must then stop using your data for those purposes.
Withdraw consent at any time, without affecting the lawfulness of earlier processing.
Exercise the protections under Article 22 GDPR where a decision is based solely on automated processing and produces legal or similarly significant effects, subject to the exceptions and safeguards in that Article.

To exercise your rights regarding Hiyara’s processing, contact hello@wearhiyara.com. We may request proportionate information to verify your identity. We normally respond within one month. Where a lawful extension is necessary, we will explain it within that initial period.

Complaints

You may complain to a data-protection supervisory authority, in particular in the EU Member State where you habitually reside, work or believe an infringement occurred. You do not have to contact us first.

The supervisory authority for our location is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Postfach 221
30002 Hannover
Germany

Website and complaint information:
https://www.lfd.niedersachsen.de/beschwerde

Additional choices under applicable US privacy laws

Depending on your location and whether the relevant law applies, you may have additional rights, including access, correction, deletion, an appeal of a request decision, and an opt-out of certain uses considered a sale, sharing or targeted advertising.

Our data-sharing opt-out page is:
https://wearhiyara.com/pages/data-sharing-opt-out

You may also contact hello@wearhiyara.com. Where applicable, Shopify’s integrated privacy tools recognise supported Global Privacy Control signals for the relevant browser and device. Shopify’s Privacy Portal provides choices regarding its own processing.

We do not discriminate against you for exercising applicable privacy rights. Authorised agents may submit requests where permitted by law, subject to verification of their authority.

Whether you must provide information

Newsletter registration is voluntary. Information necessary to process and deliver an order or meet a legal obligation must be provided if you wish to complete the relevant purchase. Without it, we may be unable to fulfil the order. Optional information is not required unless clearly indicated for a feature you choose to use.

For an online withdrawal, we need information identifying you and the relevant contract, together with an email address for the acknowledgement. An order number is helpful but is not mandatory in our form if the contract can be identified in another way. You do not need to give a reason for a statutory withdrawal. You may also notify us by email or post as explained in our Refund Policy.

External links and children’s information

External websites linked from Hiyara operate under their own privacy notices. A link alone does not give those websites access to information entered in our signup form.

Our store and newsletter are not directed at children. If you believe a child has provided personal data without the necessary authorisation, please contact us so we can investigate and take appropriate action.

Security and changes to this policy

We use appropriate technical and organisational measures to protect personal data. No website or transmission method can guarantee absolute security.

We update this policy when our processing or legal requirements change. The current version is published on our website with its update date. Where legally required, we provide additional notice or obtain fresh consent before introducing a new use.

For any privacy question, contact hello@wearhiyara.com.

Online withdrawal function — Revoq

Our online withdrawal function, linked in the footer as “Withdraw from contract”, uses Revoq — EU Withdrawal Button. The provider is Jonas Busch, a sole trader in Germany. Hiyara remains the controller; the provider processes withdrawal information on our behalf under an Article 28 GDPR data-processing agreement.

Information and purpose

The function processes your name, email address, contract or order reference where supplied, selected products or other identifying details, the declaration’s content, its date and time, the acknowledgement and handling status. It also processes information you voluntarily include and technical information needed to operate and secure the service, such as browser language and request metadata.

We use this information to identify the relevant purchase, record your declaration, send you an acknowledgement, notify Hiyara and handle the withdrawal. Where an order is matched, relevant order information is obtained from Shopify. Our legal bases are described in section 3. Using this function does not subscribe you to marketing, and marketing consent is not required.

Supporting providers and international processing

According to the provider’s documentation, supporting services include Supabase for database hosting in Frankfurt, Fly.io for application hosting in Amsterdam and Frankfurt, and Resend for email delivery using an Irish region. Shopify supports order matching. Revoq also uses Sentry for technical error monitoring, with customer-identifying data filtered according to its documentation.

Some supporting providers are based outside the EEA. EU hosting does not rule out international processing. Revoq’s contractual documentation describes safeguards including standard contractual clauses and applicable adequacy arrangements. Section 9 explains how to request information about relevant safeguards.

Retention and your choices

We retain withdrawal records according to the criteria in section 10. Deleting an app record does not necessarily delete copies lawfully retained in our email or order records. You can contact Hiyara to exercise your privacy rights. You may also declare a withdrawal by email or post; the online function is an additional channel.

Provider information:
Revoq Privacy Policy
Revoq Data Processing Agreement