Privacy
Information under Art. 13 and 14 GDPR
1. Controller
Kopftuch.shop – Inhaber Md Mahabub Ullah Khan
Inhaber: Md Mahabub Ullah Khan
Schubertstraße 3
44145 Dortmund
Deutschland
E-mail: my@kopftuch.shop
2. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time. An e-mail to my@kopftuch.shop is enough; we reply within one month. You may also complain to the data protection authority of North Rhine-Westphalia, Düsseldorf.
3. What we process
| Purpose | Data, legal basis, retention |
|---|---|
| Visiting the site | IP address, time, page, browser. Art. 6(1)(f) – operation and security. Logs deleted after 7 days. |
| Shopping cart | Session identifier and chosen items. Art. 6(1)(b). Deleted after 30 days of inactivity. |
| Order | Name, delivery and billing address, e-mail, phone, order content, payment method. Art. 6(1)(b). Retained 10 years under German tax and commercial law. |
| Account | E-mail, password (bcrypt hash only, unreadable to us), name, language. Art. 6(1)(b). |
| Newsletter | E-mail, time and IP of sign-up and confirmation (double opt-in proof). Art. 6(1)(a). Deleted after unsubscribe. |
| B2B price request | Company, VAT ID, contact, e-mail, phone, quantity, target price. Art. 6(1)(b) – pre-contractual on your initiative. Deleted after 2 years. |
4. Recipients
When you buy from an independent seller, that seller receives your name, delivery address and order content in order to ship and handle withdrawal, and is an independent controller for that data. We also use Hostinger (hosting, EU servers), Stripe Payments Europe (card, Apple Pay, Google Pay — card data is entered at Stripe and never reaches our server), PayPal (Europe), carriers, and our tax advisor and authorities where legally required.
5. Cookies and fonts
We use strictly necessary cookies only: session for cart and login, language choice, and your cookie decision. We currently use no analytics or marketing cookies and no tracking.
6. Security
All traffic is encrypted via HTTPS. Passwords are bcrypt-hashed and unreadable to us. There is no profiling or automated decision-making under Art. 22 GDPR.
Last updated: 2026-09-29