Privacy Policy

1. Data Controller

Shodai GbR, Karl-Liebknecht-Straße 17, 03046 Cottbus, Germany — info@shodai.de, data protection enquiries: datenschutz@shodai.de

2. Data We Collect

We collect the data you give us when you register or order (name, email address, phone number, delivery address, your orders and, if you use it, your wallet balance), and the messages you send us through the contact form or by email. Card payments are handled by our payment provider; we never see your full card number. When you visit the site our server also records technical data such as your IP address and the pages requested.

3. Purpose and Legal Basis

Your data is used to process and deliver your orders, to contact you about them, for customer service, and to meet legal duties such as tax record-keeping. Legal bases: performance of the contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)), our legitimate interest in running the shop securely and answering your enquiries (Art. 6(1)(f)) and, for notifications, your consent (Art. 6(1)(a)). We do not sell your personal data.

4. Service Providers We Use

• Card payments: SumUp processes card payments; it receives the payment details you enter and the order amount.
• Delivery: for addresses beyond 5 km we pass your name, address and contact details to DPD. For local delivery our own riders see your name, address and phone number; while your order is out for delivery, you can see the rider's live location on your order page.
• Address check: to find out whether your address is within 5 km of one of our shops (cash on delivery, delivery times), the address you enter is sent to OpenStreetMap's Nominatim service and, as a fallback, to the Photon service.
• Maps: the tracking map loads map tiles from OpenStreetMap, which means your IP address is transmitted to the OpenStreetMap servers.
• Sign in with Google: if you choose it, Google handles the sign-in and tells us your name and email address.
• Emails: order, account and contact emails are sent and received through our own mail server, which runs on the same server as the shop.
• Notifications (optional): if you switch on notifications in the bell menu, your browser creates a subscription that our server stores (technical address of your browser, encryption keys, the shop area you chose). Messages are delivered through the push service of your browser vendor (for example Google, Mozilla or Apple). You can switch notifications off at any time in the bell menu or in your browser settings, which deletes the subscription. In the Shodai Android app, notifications are delivered through Google Firebase Cloud Messaging: our server stores the app’s notification token together with the shop area and language you chose (and your account, if you are signed in). It is deleted when you switch notifications off or delete your account.
• Hosting: the website, its database and our mail server run on a server rented from Contabo.

5. How Long We Keep Data

Order, invoice and payment records are kept for 10 years because of tax and commercial law (Section 147 AO, Section 257 HGB). Your account data is kept until you ask us to delete your account, unless we must keep it for those legal duties. Messages from the contact form are deleted once your request is resolved, unless legal retention duties apply. Notification subscriptions are kept until you switch them off or your browser revokes them.

6. Your Rights

Under GDPR you have the right to access, correct, delete, restrict the processing of your personal data, to data portability, and to object to processing based on legitimate interests. You can withdraw a consent at any time with effect for the future. You may also complain to a data protection supervisory authority. You can delete your account yourself under Account → Account Settings → Delete account (see also www.shodai.de/en/delete-account). Contact us at: datenschutz@shodai.de

7. Cookies and Browser Storage

We only use technically necessary cookies and browser storage: your cart, sign-in, delivery area, your notification choice and the acknowledgement of the cookie notice. We do not use analytics or advertising cookies or trackers.