Privacy Policy

Last updated: 10 September 2026

Punelia is operated from Germany. That means the EU General Data Protection Regulation (GDPR) applies to everything we do with your personal data, wherever in the world you live. Because we sell to customers in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply alongside it.

1. Who is responsible

The controller for your personal data is:

Benjamin Huse
Ortolanweg 70
12359 Berlin
Deutschland
Email: admin@punelia.com

2. What we collect, why, and on what legal basis

Name, delivery and billing address, email, phone number — to take your order, deliver it and contact you about it. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Payment details, handled by our payment providers — we never see full card numbers. To take payment and prevent fraud. Legal basis: performance of a contract, Art. 6(1)(b); our legitimate interest in preventing fraud, Art. 6(1)(f).
Order history, returns and refunds — to handle returns, refunds and warranty claims and to keep the records tax law requires. Legal basis: Art. 6(1)(b) and legal obligation, Art. 6(1)(c).
Messages you send us — to answer you. Legal basis: our legitimate interest in customer service, Art. 6(1)(f).
Device and browsing data, cookies and similar technologies — to run the shop, keep your basket and understand how the site is used. This includes the Meta pixel and session analytics, which run only where you have consented. Legal basis: for strictly necessary cookies, Art. 6(1)(f) and § 25(2) TDDDG; for everything else, your consent, Art. 6(1)(a) and § 25(1) TDDDG.
Email address for our newsletter — to send you the emails you asked for. Legal basis: your consent, Art. 6(1)(a).

Giving us your name, address and payment details is necessary to form a contract with us. Without them we cannot take or deliver your order. Everything else is optional.

3. Who receives your data

Shopify — the platform this shop runs on, and our processor for hosting, checkout and order handling.
Payment providers — they receive payment data directly and act as controllers in their own right for it.
Fulfilment and shipping partners — they receive the delivery address needed to get your parcel to you.
Meta and analytics services — only where you have consented through our cookie banner.
Tax advisers and authorities — where the law requires it.

We do not sell your personal data.

4. Transfers outside the EU and Australia

Some of our processors are based outside the EU and Australia, including in the United States. Where that happens, the transfer is covered either by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses together with additional safeguards. You can ask us for a copy of the safeguards that apply, using the contact details in section 1.

5. How long we keep it

Order and invoice data: ten years, because German commercial and tax law requires it (§ 147 AO, § 257 HGB).
Customer account data: until you delete the account, and then only what the retention rules above still require.
Support messages: up to three years after the matter is closed.
Newsletter: until you unsubscribe.
Cookies and analytics: as set out in our cookie banner; consent-based cookies are deleted when you withdraw consent.

6. Your rights

Access the personal data we hold about you and get a copy of it (Art. 15 GDPR, APP 12).
Correct data that is wrong or incomplete (Art. 16 GDPR, APP 13).
Erase your data where we no longer have a reason to keep it (Art. 17).
Restrict what we do with it while a dispute is resolved (Art. 18).
Receive it in a portable format and have it sent to another provider (Art. 20).
Object to processing based on our legitimate interests, including profiling (Art. 21). If you object to direct marketing, we stop — no reason needed.
Withdraw your consent at any time, without affecting anything we did before you withdrew it (Art. 7(3)).

Write to admin@punelia.com and we will answer within one month.

7. Complaining to a supervisory authority

If you think we have handled your data badly, you can complain to a data protection authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
mailbox@datenschutz-berlin.de

If you live in Australia you can also complain to the Office of the Australian Information Commissioner, oaic.gov.au.

8. Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you in a way that has legal effects for you. Our payment providers may run automated fraud checks as part of authorising a payment.

9. Children

This shop is not aimed at children and we do not knowingly collect data about them. If you believe a child has given us their data, write to admin@punelia.com and we will delete it.