- Data Controller & Overview
This Privacy Policy explains how personal data is collected, processed, and retained when you visit or make a purchase via www.sunhatry.com.
The data controller responsible for all data processing activities on this website under the General Data Protection Regulation (GDPR) and applicable German data protection law is:www.sunhatry.com
Contact Email: sunhat@sunhatry.com
- Categories of Personal Data Collected
We collect and process personal data strictly necessary to operate our online store, fulfil purchase contracts, respond to inquiries, and comply with legal statutory obligations.
Depending on your interactions on www.sunhatry.com, we may collect the following information:
Identity & Contact Details: Full name, billing address, shipping address, email address, and phone number.
Transaction Data: Details regarding products ordered, order reference numbers, purchase history, and transaction amounts.
Technical & Usage Data: IP address, browser identification, device characteristics, operating system, time zone settings, and access timestamps collected via server log files.
- Legal Basis for Processing
We process personal data in accordance with the legal grounds established under Article 6(1) of the General Data Protection Regulation (GDPR):
Performance of a Contract (Art. 6(1)(b) GDPR): Processing required to manage orders, process deliveries, collect payments, and provide customer support.
Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Processing necessary to adhere to statutory accounting, commercial, and tax obligations under German law.
Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate commercial interests in ensuring administrative stability, website functionality, and business operations, provided your fundamental rights do not override those interests.
- Payment Processing via Stripe
To provide standard payment options for your orders, payment details are transferred to and processed by our third-party payment service provider:
Payment Processor: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).
When you complete a transaction on www.sunhatry.com, the payment details you provide (such as payment method, card detail placeholders, transaction total, currency, IP address, and identity details necessary to complete the payment) are transmitted directly to Stripe.
The processing of payment information by Stripe is conducted in accordance with Article 6(1)(b) GDPR for contract fulfillment. Stripe operates as an independent data controller for payment authorization and security checks. Details regarding Stripe’s data privacy practices can be consulted in the official Stripe Privacy Policy.
- Data Retention Periods
Personal data collected via www.sunhatry.com is retained only for as long as necessary to fulfill the specific operational purpose for which it was gathered, or as required under applicable statutory storage periods governed by German commercial and tax statutes.
General Customer & Order Data: Retained for the duration of the operational customer relationship and statutory standard limitation periods.
Commercial & Tax Records: Under Section 147 of the German Fiscal Code (Abgabenordnung – AO) and Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB), transactional documentation, order invoices, and payment records are retained for up to 10 years.
General Inquiries & Correspondence: Retained for as long as needed to address and resolve your specific request, after which it is deleted or archived unless further retention is legally mandated.
Upon expiration of statutory retention periods, personal data is routinely erased or anonymised in accordance with data protection guidelines.
- Data Transfers & Security Measures
Your personal data is transmitted using encrypted transport layers (such as TLS/SSL) to safeguard information against unauthorized access, loss, or alteration. While we implement standard technical and organizational measures to secure data handling across our infrastructure, no transmission over the internet can be asserted as entirely immune to external risk.
We do not sell, rent, or trade personal data to third parties. Data transfers are limited to essential operational partners, such as payment gateways (Stripe), logistics carriers, and system maintenance providers operating under standard processor contracts or direct legal mandates.
- Your Statutory Rights under European Law
Under the General Data Protection Regulation (GDPR), visitors and customers residing within the European Union possess specific statutory rights regarding their personal data:
Right of Access (Art. 15 GDPR): The right to request cowhether your personal data is being processed and to receive a copy of that data.
Right to Rectification (Art. 16 GDPR): The right to request the correction of inaccurate or incomplete personal data.
Right to Erasure (Art. 17 GDPR): The right to request the deletion of your personal data when statutory processing conditions no longer apply.
Right to Restriction of Processing (Art. 18 GDPR): The right to request limited data processing under defined statutory circumstances.
Right to Data Portability (Art. 20 GDPR): The right to receive personal data provided to us in a structured, standard format.
Right to Object (Art. 21 GDPR): The right to object to processing based on legitimate interests (Art. 6(1)(f) GDPR).
Right to Lodge a Complaint: The right to submit a formal complaint with a competent data protection supervisory authority, particularly within the Federal Republic of Germany.
To exercise any of your statutory data privacy rights, please direct your request to sunhat@sunhatry.com.