Privacy policy

Last updated: 7 October 2026

This policy explains which personal data Valkental GmbH processes when you visit uk.valkental.com or us.valkental.com, order from us or get in touch, why we do it, who receives the data and which rights you have. Section 11 adds information for residents of the United States.

1. Who is responsible

Valkental GmbH, Rheinpromenade 9, 40789 Monheim am Rhein, Germany
Email: support@valkental.de

Data protection officer: Niklas Hanitsch, secjur GmbH, Steinhöft 9, 20459 Hamburg, Germany, dsb@secjur.com, +49 40 228 599 520

2. Visiting our shop

Our shop runs on Shopify. Each time you open a page, your browser sends technical data to Shopify's servers: IP address, browser and operating system, the pages you view, the page you came from, and the date and time. Shopify uses this to deliver the pages, keep the shop secure and detect fraud and misuse. From your IP address we work out which country you're in so you see the right store (UK in GBP, US in USD).

Legal basis: our legitimate interest in a secure, working shop (Art. 6(1)(f) UK GDPR / GDPR).

3. Cookies and similar technologies

Necessary cookies make the shop work: cart, checkout, country and currency, login and your cookie choice (for example cart, localization, _shopify_essential, _tracking_consent). We set them without asking because the shop can't work without them (legitimate interest, Art. 6(1)(f)).

Analytics and marketing cookies come from Google Analytics, Google Ads and the Meta Pixel (for example _ga, _gcl_au, _fbp). They show us how the shop is used, measure our ads and let us show you relevant ads on other websites.

  • UK: these cookies only load after you agree in our cookie banner (consent, Art. 6(1)(a)). You can withdraw your consent at any time by deleting the cookies for our website, after which the banner appears again, or by emailing us.
  • US: these cookies are active by default. You can opt out at any time, see section 11.

Providers: Google Ireland Limited, Dublin, Ireland (privacy policy) and Meta Platforms Ireland Limited, Dublin, Ireland (privacy policy). For collecting and transmitting data through the Meta Pixel, we and Meta are joint controllers (Art. 26 GDPR); Meta alone is responsible for what it does with the data afterwards. Google Analytics data is deleted after 14 months.

4. Placing an order

When you order, we process your name, delivery and billing address, email address, phone number (if you give it), the items you order, your payment method and your order history. We use these data to process and deliver your order, send you order and shipping emails, handle returns, refunds and complaints, and clear customs.

Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligations under commercial, tax and customs law (Art. 6(1)(c)).

Shop platform: Shopify International Limited, Dublin, Ireland, hosts our shop and checkout and processes all order data on our behalf, together with Shopify Inc., Ottawa, Canada, and its affiliates (privacy policy). Shopify also checks orders for fraud using order and device data (legitimate interest in preventing fraud, Art. 6(1)(f)).

Payment: your payment is handled by the provider you choose; we never see your full card details.

  • Cards, Apple Pay and Google Pay through Shopify Payments: Stripe Payments Europe, Limited, Dublin, Ireland (privacy policy)
  • Apple Pay: Apple Distribution International Ltd., Cork, Ireland. Google Pay: Google Ireland Limited, Dublin, Ireland
  • Shop Pay: Shopify (see above)
  • PayPal, if you pay with PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg (privacy policy)

Delivery and customs: our fulfilment partner, whose warehouse is in China, receives your name, delivery address, phone number, email address and the items you ordered so it can pack and ship your order. The carrier and customs broker in your country receive the data they need to deliver your parcel and clear customs. Because we pay import duties and taxes for you, your name, address and the value of your order appear on the import declaration to HM Revenue & Customs (UK) or U.S. Customs and Border Protection (US).

Customer account: you can create an account to see your orders and saved addresses. You sign in with a one-time code sent to your email address. You can ask us to delete your account at any time.

5. Contacting us

When you email us or use one of our forms, we process your name, email address, order number, your message and any photos you send, to answer your request. Legal basis: performance of the contract where your request concerns an order (Art. 6(1)(b)), otherwise our legitimate interest in answering you (Art. 6(1)(f)).

Service providers: Zendesk, Inc., San Francisco, USA (customer service tickets, privacy policy), united-domains, Starnberg, Germany (email hosting) and Typeform S.L., Barcelona, Spain (contact forms with photo upload, privacy policy).

6. Newsletter

We only send you marketing emails if you sign up, either through our newsletter form or by ticking the box at checkout. We process your email address and, if you give it, your name, and we record when and how you signed up. We measure whether our emails are opened and which links are clicked so we can improve them. You can unsubscribe at any time with the link in every email.

Legal basis: your consent (Art. 6(1)(a)). Service provider: Klaviyo, Inc., Boston, USA (privacy policy).

7. Product reviews

After delivery we may send you an email inviting you to review your purchase. If you write a review, it's published in our shop with the name you enter. Service provider: REVIEWS.io, United Kingdom (privacy policy). Legal basis: our legitimate interest in feedback on our products (Art. 6(1)(f)); you can object at any time using the link in the invitation or by emailing us.

8. International transfers

We are based in Germany. Some of the recipients named above process data outside the UK and the European Economic Area:

  • Canada (Shopify): covered by adequacy decisions of the UK and the EU.
  • United States (Shopify, Google, Meta, Klaviyo, Zendesk): based on the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified, otherwise on standard contractual clauses.
  • China (our fulfilment partner): the transfer is necessary to ship the order you placed with us (Art. 49(1)(b)).

Data flows between the UK and the EU are covered by adequacy decisions.

9. How long we keep your data

  • Orders and invoices: as long as German commercial and tax law requires us to keep them (up to 10 years).
  • Customer account: until you delete it or ask us to.
  • Customer service requests: until your request is resolved; if it concerns an order, as long as the order data.
  • Newsletter: until you unsubscribe. After that we keep your email address on a block list so you don't receive any more emails.
  • Analytics data: 14 months.

10. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interests. You can object to direct marketing at any time. You can withdraw any consent at any time with effect for the future.

To exercise your rights, email support@valkental.de or our data protection officer.

You can also complain to a data protection authority, in the UK to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Düsseldorf, Germany (ldi.nrw.de).

11. Information for US residents

What we collect. In the last 12 months we have collected these categories of personal information: identifiers (name, postal and email address, phone number, IP address, cookie and device IDs); customer records (billing address, payment method; card details stay with the payment provider); commercial information (orders, returns, discount codes used); internet activity (pages viewed, interactions with our shop and emails); approximate location derived from your IP address; photos you send us with a complaint. We collect them from you, from your browser or device, and from our payment, shipping and service providers, for the purposes described in sections 2 to 7. We don't use sensitive personal information to infer characteristics about you.

Who receives it. We disclose personal information for business purposes to the service providers named in sections 3 to 7.

Sale and sharing. We don't sell personal information for money. The analytics and advertising cookies from Google and Meta (section 3) may count as a "sale" or "sharing" of personal information or as "targeted advertising" under California and other state privacy laws. You can opt out at any time on our Your privacy choices page. We also treat a Global Privacy Control (GPC) signal from your browser as an opt-out. We don't knowingly sell or share personal information of consumers under 16.

Your rights. Depending on the state you live in, you have the right to know what personal information we hold about you and to get a copy, to have it corrected or deleted, and to opt out of its sale, sharing or use for targeted advertising. We won't treat you differently for exercising your rights.

How to make a request. Email support@valkental.de. We verify your request by matching your email address and order details, and answer within 45 days. An authorized agent can make a request for you with your signed permission. If we decline your request, you can appeal by replying to our decision; if we turn down your appeal, you can contact the attorney general of your state.

How long we keep it. See section 9.

12. Children

Our shop is not directed at children under 16, and we don't knowingly collect personal data from them.

13. Changes to this policy

We update this policy when our shop or our service providers change. The date at the top shows when it was last updated.