Privacy Policy – FUENF BY MUSINA

*This English version is provided for the convenience of international customers. In case of discrepancies, the German-language Datenschutzerklärung is authoritative, as the controller is established in Germany and the site is governed by German and EU law (GDPR).*

1. Overview

When you visit or shop at fuenfberlin.com, we process personal data about you. Personal data is any information that can be used to identify you personally. This policy explains what data we collect, why, how long we keep it, and what rights you have.

Who is responsible for data processing? The shop operator, see "Controller" below.

How do we collect your data? Partly through data you actively provide (e.g. filling in the order/contact form or newsletter sign-up), and partly automatically when you visit the site — or, for non-essential services, only after you give consent.

What do we use your data for? Some data is collected to ensure the website functions correctly. Data submitted through the order form is used to process your order and communicate with you. With your consent, we also use analytics and marketing services to improve our offering and advertising.

Your rights: You have the right to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data, to request correction or deletion, and to withdraw any consent given at any time with effect for the future. You also have a right to lodge a complaint with the competent supervisory authority. See section 12 below for details.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ekaterina Zdanowicz-Musina

FUENF BY MUSINA

Grünberger Str. 35

10245 Berlin

Germany

Phone: +49 15786753596

Email: info@fuenfberlin.com

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Hosting and Sub-Processors

This shop is operated on the platform of an external hosting provider (Tilda Publishing). Personal data collected in the shop is stored on the hosting provider's servers — in particular IP addresses, order and contact data, meta and communication data, names, website access data and other data generated through the shop.

The hosting provider is used for the purpose of contract fulfilment towards our customers (Art. 6(1)(b) GDPR) and in our legitimate interest in a secure, fast and efficient provision of our online offering (Art. 6(1)(f) GDPR). We have entered into a data processing agreement (DPA) with the provider.

In addition to hosting, we use further third-party services for analytics, advertising, video and other functions (including Google, Meta, Yandex, Vectary), each described in the relevant section below.

Transfers to third countries: Processing generally takes place within the European Union. For certain embedded services — in particular US-based providers such as Google and Meta, and the Russian provider Yandex — data is also transferred outside the EU/EEA. Where this applies, it is stated in the relevant section, together with the safeguard relied on (e.g. EU-US Data Privacy Framework, Standard Contractual Clauses, explicit consent).

4. General Information and Mandatory Disclosures

Retention period

Unless a more specific retention period is stated in this policy, your personal data remains with us until the purpose for processing no longer applies. Where you assert a legitimate right to erasure or withdraw consent, your data will be deleted unless we have other legally permissible grounds for continued storage (e.g. statutory retention obligations under German tax and commercial law); in that case, deletion takes place once those grounds cease to apply.

Legal bases for processing

Where you have given consent, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where you have given explicit consent to a transfer of personal data to third countries, processing is additionally based on Art. 49(1)(a) GDPR. Where you have consented to the storage of cookies or access to information on your device, processing is additionally based on § 25(1) TTDSG (German Telecommunications-Telemedia Data Protection Act). Consent can be withdrawn at any time.

For order processing, we rely on Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). Where we are subject to a legal obligation (e.g. tax retention duties), we rely on Art. 6(1)(c) GDPR. Otherwise, processing may be based on our legitimate interest under Art. 6(1)(f) GDPR.

Right to object to data collection in specific cases, and to direct marketing (Art. 21 GDPR)

Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing.

Right to lodge a complaint with a supervisory authority

In the event of GDPR violations, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The competent authority for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information.

Right to data portability

You have the right to receive personal data which we process automatically on the basis of your consent or in performance of a contract, in a common, machine-readable format, either for yourself or to be transmitted to another controller, insofar as technically feasible.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content (e.g. orders), this shop uses SSL/TLS encryption, recognizable by "https://" in the address bar and the padlock icon in your browser.

5. Forms: Order/Contact Form and Newsletter Sign-Up

Order and contact form

When you send us a request or order through the order/contact form, we collect the information requested there — name, email address, phone number and, where provided, a discount/promo code — in order to process your request or order and to answer any follow-up questions. We do not pass this data on without your consent, except where disclosure to shipping and payment providers is necessary to fulfil the contract (see section 6).

Processing is based on Art. 6(1)(b) GDPR where the request relates to performance of a contract or pre-contractual measures. In all other cases, processing is based on our legitimate interest in responding to inquiries addressed to us (Art. 6(1)(f) GDPR).

Retention: Data remains with us until you request its deletion or the purpose for storage no longer applies (e.g. once your request has been fully processed), without prejudice to statutory retention periods for business and accounting records (generally 6 or 10 years under German tax and commercial law).

Newsletter sign-up

When you sign up for our newsletter, you provide us with your email address, which we use to send the newsletter. Processing is based exclusively on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, e.g. via the unsubscribe link in every newsletter or by message to info@fuenfberlin.com.

Your email address is stored until you unsubscribe, at which point it is removed from the mailing list.

6. Order Processing, Payment and Shipping

To process your order, we collect and process the data required for the purchase contract (name, delivery and, where applicable, billing address, email, phone number, order contents, payment data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Payment: We use external payment service providers to process payments; the available options are shown to you during checkout. Payment data you enter there is transmitted directly to the respective payment provider and processed under that provider's own privacy policy.

Shipping: To deliver your order, we transmit the data necessary for shipping (name, delivery address, and where applicable phone number/email) to the shipping company we engage. The legal basis is Art. 6(1)(b) GDPR.

Retention: Order and invoice data is retained in accordance with statutory retention periods under German commercial and tax law (generally 6 or 10 years).

7. Cookies

This shop uses cookies and comparable technologies. Cookies are small text files stored on your device. Some cookies are technically necessary (session cookies); others serve analytics or advertising purposes and are only set with your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG).

Important note on the current state: An audit of this shop found that several non-essential cookies and services (Google Analytics, Google Tag Manager, Google Ads/DoubleClick, Meta Pixel, Yandex Metrica, YouTube) are currently loaded before active consent is given. This does not meet the requirements of § 25(1) TTDSG and must be corrected technically (a consent tool that blocks loading until consent is given); see the note at the end of this document.

The following cookies have been identified:

| Cookie | Provider | Purpose | Category | Legal basis |

|---|---|---|---|---|

| `_ga`, `_gid`, `_gat_UA-198320476-1` | Google Ireland Limited | Google Analytics – web analytics, visitor distinction | Analytics (non-essential) | Consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

| Cookies set via Google Tag Manager | Google Ireland Limited | Management/triggering of other tracking tags | Analytics/Marketing (non-essential) | Consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

| e.g. `_fbp` (typical for Meta Pixel) | Meta Platforms Ireland Limited | Reach measurement, retargeting, ad optimization | Marketing (non-essential) | Consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

| Cookies from Google Ads/DoubleClick (googleads.g.doubleclick.net, stats.g.doubleclick.net) | Google Ireland Limited | Ad measurement and retargeting | Marketing (non-essential) | Consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

| e.g. `_ym_uid`, `_ym_d` (typical for Yandex Metrica) | Yandex LLC, Russia | Web analytics | Analytics (non-essential) | Explicit consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

| `VISITOR_INFO1_LIVE`, `YSC`, `__Secure-YNID` | Google Ireland Limited (YouTube) | Playback of embedded YouTube videos, reach measurement | Functional/Marketing (non-essential unless in privacy-enhanced mode) | Consent, Art. 6(1)(a) GDPR, § 25(1) TTDSG |

This table will be updated whenever the services in use change. You can configure your browser to notify you when cookies are set, to allow cookies only on a case-by-case basis, or to reject them generally. Disabling cookies may limit the functionality of this shop.

Consent via cookie consent tool

This shop uses (or is intended to use) a cookie consent tool to obtain and document your consent to the use of non-essential cookies in a GDPR-compliant manner. When you first enter the shop, a consent banner is displayed where you can accept or decline non-essential technologies; declining must be as easy as accepting. Your choice is stored and can be withdrawn at any time with future effect via the cookie settings.

8. Web Analytics and Online Advertising

Google Analytics

This shop uses the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us to analyze visitor behavior (e.g. page views, time on page, origin). Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. Without your consent, no analytics cookies are set.

Data transfer to the US is based on the EU-US Data Privacy Framework (DPF). Further information: https://www.dataprivacyframework.gov/ and in Google's privacy policy: https://policies.google.com/privacy. We have entered into a data processing agreement with Google.

Google Ads and Google Tag Manager

We use Google Tag Manager to manage website tags, and may use Google Ads/DoubleClick to measure the success of our online advertising campaigns (conversion tracking, remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager itself does not set cookies but triggers other tags, which may in turn set cookies; this policy covers the services embedded through it. Google Ads/DoubleClick sets cookies that allow us to see whether an ad led to a desired action (e.g. a purchase).

Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. Data transfer to the US is based on the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy

Meta Pixel (Facebook Pixel)

This shop uses Meta's visitor action pixel for reach measurement and advertising purposes. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel allows us to identify visitors to our shop as an audience for Meta Ads and to evaluate the effectiveness of our advertising. Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG.

To the extent personal data is collected and forwarded to Meta, we and Meta Platforms Ireland Limited are joint controllers for this step (Art. 26 GDPR); subsequent processing by Meta is not part of this joint controllership. Data transfer to the US is based on the EU-US Data Privacy Framework. Further information: https://www.facebook.com/privacy/policy/

Yandex Metrica

This shop embeds (as of this audit) the Yandex Metrica web analytics service. The provider is Yandex LLC, Lva Tolstogo str. 16, 119021 Moscow, Russia.

Yandex Metrica enables analysis of visitor behavior comparable to Google Analytics. Special note on transfers to Russia: There is no adequacy decision by the European Commission for Russia under Art. 45 GDPR. A transfer of personal data to Russia therefore carries an elevated risk, in particular regarding potential government access and a level of protection lower than under the GDPR.

Use is based exclusively on your explicit consent to a transfer to a third country without an adequacy decision (Art. 49(1)(a) GDPR in conjunction with Art. 6(1)(a) GDPR and § 25(1) TTDSG). Without this separate consent, no Yandex Metrica cookies are set and no data is transferred. Consent can be withdrawn at any time with future effect. Further information: https://yandex.com/legal/confidential/

9. YouTube Videos

This website may embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you open a page with an embedded video, your browser establishes a connection to YouTube/Google's servers, allowing YouTube to learn which of our pages you visited. This may set cookies such as `VISITOR_INFO1_LIVE`, `YSC` or `__Secure-YNID`, used among other things to collect usage statistics, improve usability, and prevent fraudulent use.

Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. Without your consent, embedded videos are not loaded, or are only played after an explicit click (two-click solution). Further information on YouTube's data practices: https://policies.google.com/privacy

10. Google Fonts

This website uses so-called web fonts provided by Google for a consistent display of typefaces. These fonts are loaded from Google's servers, not hosted locally on our own server. When you open a page, your browser connects to Google's servers, which allows Google to learn that our website was accessed from your IP address.

This use serves our legitimate interest in a consistent and visually appealing presentation of our offering under Art. 6(1)(f) GDPR. Where corresponding consent is requested, processing is based exclusively on Art. 6(1)(a) GDPR and § 25(1) TTDSG.

Further information: https://developers.google.com/fonts/faq and https://policies.google.com/privacy. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

11. Vectary (3D Product Viewer) and IP-Based Country Detection

Vectary: For interactive 3D product display, we embed the Vectary service (app.vectary.com). When you open a page with a 3D view, your browser connects to Vectary's servers or the associated CDN, transmitting your IP address. Use is based on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG, unless the service is embedded on a purely technically necessary basis. Further information on Vectary is available in its own privacy policy.

IP-based country detection (get.geojs.io): To show you, for example, the appropriate language, currency or shipping options, we determine your approximate country from your IP address via the get.geojs.io service. Your IP address is transmitted to that provider in the process. Where technically necessary for the basic function of the shop, we rely on our legitimate interest (Art. 6(1)(f) GDPR); otherwise on your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG).

12. Your Rights at a Glance

You have the following rights at any time:

• Access (Art. 15 GDPR) to the personal data we process about you
• Rectification (Art. 16 GDPR) of inaccurate data
• Erasure (Art. 17 GDPR) of data stored about you
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to processing
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future
• Complaint to a supervisory authority (Art. 77 GDPR)

To exercise your rights, an informal message to info@fuenfberlin.com is sufficient.

13. Withdrawing Consent and Cookie Settings

You may withdraw your consent to non-essential cookies and services (Google Analytics, Google Ads/DoubleClick, Meta Pixel, Yandex Metrica, YouTube, Vectary, etc.) at any time with future effect — via the "Cookie Settings" link in the footer of this website, or by informal message to info@fuenfberlin.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

---