Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains how House of MIRCHI processes personal data when you visit www.mirchihouse.com, purchase products, contact us or use our online services.

“Personal data” means information relating to an identified or identifiable person, such as a name, address, email address or online identifier.

1. Who Is Responsible for Your Data?

The controller responsible for the processing described in this policy is:

Jahnavi Manne, trading as House of MIRCHI
Sole Proprietor
Lueneburger Str. 25
39106 Magdeburg
Germany

Email: info@mirchihouse.com
Website: https://www.mirchihouse.com

You can contact us at this email address regarding this policy or your data protection rights.

2. Why We Process Personal Data

We process personal data for specific purposes and on an appropriate legal basis under the General Data Protection Regulation (GDPR).

Depending on the activity, these bases include:

  • Article 6(1)(b) GDPR: processing necessary to fulfil a contract or take steps you request before entering into a contract.
  • Article 6(1)(c) GDPR: processing necessary to comply with legal obligations, including tax, accounting and consumer-protection requirements.
  • Article 6(1)(f) GDPR: processing necessary for legitimate interests, such as operating a secure website, responding to general enquiries and establishing or defending legal claims, subject to the required balancing of interests.
  • Article 6(1)(a) GDPR: processing based on your consent, where required—for example, for optional marketing or certain tracking technologies.

Reading this policy does not itself constitute consent to optional processing.

3. Visiting Our Website and Shopify Hosting

Our online store is hosted on Shopify. For merchants in Germany, Shopify’s primary contracting entity is generally Shopify International Limited, Ireland.

When you visit our website, technical information may be processed, including:

  • IP address.
  • Browser and device information.
  • Operating system.
  • Pages requested and referring website.
  • Date and time of access.
  • Technical errors, session information and security-related events.

This information supports website delivery, troubleshooting, fraud prevention and security.

The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in providing a reliable and secure online store. Processing necessary to provide a service you request may also be based on Article 6(1)(b) GDPR.

Shopify processes data to provide its platform and may also process certain information for its own purposes, as explained in its privacy notices.

Further information:

https://www.shopify.com/legal/privacy/consumers

4. Cookies and Similar Technologies

Our website and integrated services may use cookies, local storage and similar technologies.

Some are necessary to provide functions you request, such as maintaining your basket, supporting checkout, securing a session or remembering a privacy choice.

Under §25(2) TDDDG, consent is not required for device storage or access that is strictly necessary to provide an expressly requested service. The associated processing of personal data requires a separate appropriate GDPR legal basis.

Optional analytics, advertising and other non-essential technologies require consent where applicable. Such consent is based on §25(1) TDDDG and Article 6(1)(a) GDPR.

Where optional technologies are offered, you can accept or reject them through our consent controls and subsequently change your choice. Withdrawing consent does not affect the lawfulness of earlier processing.

The relevant consent interface or cookie information should identify the technologies in use, their purposes, providers and storage periods.

5. Orders and Customer Accounts

When you place an order, we process the information needed to handle the purchase. This can include:

  • Name and contact details.
  • Billing and delivery addresses.
  • Products, quantities and prices.
  • Order and payment references.
  • Delivery or collection preferences.
  • Relevant instructions and communications.
  • Return, withdrawal and refund information.
  • We use this information to accept and fulfil orders, arrange payment and delivery, provide customer service and handle related enquiries.

The main legal basis is Article 6(1)(b) GDPR. Statutory recordkeeping is based on Article 6(1)(c) GDPR.

If you use a customer account, we also process the information necessary to provide the requested account functions, such as access to order information.

Required fields are identified during the relevant process. If information necessary to fulfil an order is not provided, we may be unable to complete the purchase or delivery.

6. Payments

We process payments using the payment services available at checkout, including Shopify Payments where offered.

Depending on the method selected, the payment provider may process payment details, transaction information, billing details, device information and information needed for authentication or fraud prevention.

Payment providers may act as independent controllers for parts of their processing. Their own privacy notices explain those activities.

The processing necessary to complete your payment is generally based on Article 6(1)(b) GDPR. Providers may also process data to meet their legal obligations or protect against fraud.

Available payment methods can vary. Please consult the information displayed for your selected payment method before completing payment.

7. DPD, DHL and Delivery Services

To deliver your order, we share the information necessary for delivery with the carrier or delivery service handling the shipment.

This normally includes the recipient’s name, delivery address and relevant shipment information.

Our shipping partners include:

DPD Deutschland GmbH
Wailandtstraße 1
63741 Aschaffenburg
Germany

DPD privacy information:
https://www.dpd.com/de/de/datenschutz/

We also use DHL, where selected for the shipment. The relevant DHL service provider processes shipment information according to its applicable privacy notice.

The legal basis for information necessary to perform delivery is Article 6(1)(b) GDPR.

Email addresses and telephone numbers are shared only where necessary for the requested delivery service or on another appropriate legal basis, including consent where required. They are not automatically shared for unrelated marketing.

For local delivery, relevant order and address information may be made available to the person responsible for delivering your order.

For collection, we process your order reference and the information needed to prepare the goods, notify you and verify collection.

8. Email, Contact Forms and Customer Support

When you contact us, we process the details you provide, including your name, email address, message and any relevant order information.

For enquiries about an order or a proposed purchase, the legal basis is Article 6(1)(b) GDPR.

For other enquiries, processing is generally based on Article 6(1)(f) GDPR and our legitimate interest in responding to communications.

We use Zoho Mail for business email. For services hosted in Zoho’s EU data centres, Zoho identifies Zoho Corporation B.V., Netherlands, as the relevant hosting processor. Other entities or subprocessors may be involved as described in Zoho’s documentation.

We also use Workflow Transactional Email in connection with Shopify Flow for configured service emails.

These providers may process recipient addresses, email content, delivery information and technical logs needed to operate the service.

A transactional message does not automatically subscribe you to marketing.

9. Electronic Withdrawal Form

We use the CC EU Widerruf Button application provided by CC Consulting GmbH, Emil-Figge-Straße 91, 44227 Dortmund, Germany, to receive and document electronic withdrawal declarations.

When you use this form, the data processed includes your name, email address, order or contract reference, receipt timestamp and any product information or comments you submit.

The purposes are to receive and document your declaration, send an acknowledgement of receipt and handle the withdrawal.

Processing is based on Article 6(1)(c) GDPR in conjunction with the applicable statutory withdrawal obligations, and Article 6(1)(b) GDPR for handling the contractual relationship. Necessary preservation of evidence may also be based on Article 6(1)(f) GDPR.

CC Consulting GmbH acts as our processor for this service. According to its privacy notice, the application is hosted within the European Union.

Withdrawal records are retained for as long as necessary to handle the declaration and meet applicable evidential and retention requirements.

You may also communicate your withdrawal by email or post. Using this form does not subscribe you to marketing.

10. Invoicing and Accounting

We use Lexware Office for invoicing and accounting, connected to our Shopify store through the Lexware Office app provided by Eshop Guide GmbH, Husemannplatz 5a, 44787 Bochum, Germany.

The integration transfers information necessary to create and manage invoices, credit notes and accounting records. Depending on the transaction, this includes customer names, billing details, order references, purchased products, prices, tax amounts and payment information.

Eshop Guide processes customer information on our behalf to provide the integration. Relevant accounting information is also processed through Lexware Office, provided by Haufe Service Center GmbH, Germany.

Processing is based on Article 6(1)(b) GDPR for contract-related invoicing and Article 6(1)(c) GDPR for applicable tax and accounting obligations.

Records are retained according to the applicable statutory requirements described in the retention section of this policy.

11. MIRCHI Golden Ticket Lucky Draw

For qualifying orders, we process information needed to administer the MIRCHI Golden Ticket promotion.

This includes the order reference, qualifying product value, ticket reference, draw month, eligibility status, contact email and relevant cancellation, return or refund information.

We use these details to assign entries, check continued eligibility, conduct the draw and communicate with participants or winners.

Processing necessary to administer participation under the published promotion terms is based on Article 6(1)(b) GDPR. Necessary fraud prevention and preservation of evidence may be based on Article 6(1)(f) GDPR.

Only the winning Golden Ticket reference is intended for publication. Customer names, email addresses, addresses and Shopify order numbers are not published as part of the winner announcement.

Although a ticket reference does not publicly identify its holder, it remains personal data where we can link it to an order.

Participation does not automatically subscribe you to advertising emails.

12. Newsletters and Optional Marketing

Where we offer newsletter registration, we use the submitted details for the marketing described when you sign up.

Where consent is required, processing is based on Article 6(1)(a) GDPR. You can unsubscribe using the link in the relevant email or by contacting us.

Withdrawal of marketing consent does not prevent essential order, payment, delivery or withdrawal communications.

Any additional newsletter provider, advertising pixel or analytics service must be identified in the applicable privacy and consent information before it is used.

13. Who Receives Personal Data?

Depending on the service used, recipients may include:

  • Shopify and relevant platform service providers.
  • Payment providers.
  • DPD, DHL and local delivery personnel.
  • Zoho and transactional email providers.
  • The withdrawal app provider.
  • Lexware and the relevant integration provider.
  • Authorised accounting, tax and legal advisers.
  • Public authorities where disclosure is legally required.

We limit disclosures to the information needed for the relevant purpose.

Where a provider acts as our processor, the required data-processing arrangements under Article 28 GDPR must govern its processing. Some recipients, such as payment providers or carriers, may act as independent controllers for their own activities.

14. International Data Transfers

Some providers and their subprocessors may process personal data outside the European Economic Area.

Where applicable, transfers rely on an appropriate mechanism under Chapter V GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where necessary.

An adequacy decision applies only within its actual scope. We do not assume that every provider or every transfer is covered merely because the destination country has an adequacy arrangement.

Contact us for information about the safeguards relevant to a particular processing activity.

15. How Long We Keep Information

We retain personal data only for as long as needed for the stated purpose, applicable legal obligations or the establishment, exercise or defence of legal claims.

In particular:

  • Order and invoice information is retained for the applicable tax and commercial-law periods.
  • General enquiries are deleted when resolved and no further retention ground applies.
  • Withdrawal records are retained as necessary to handle the withdrawal and meet documentation or legal requirements.
  • Lucky Draw records are retained as necessary to administer the promotion, resolve related issues and meet applicable obligations.
  • Marketing information is retained until consent is withdrawn or another applicable retention criterion is met. A limited suppression record may be retained to respect an unsubscribe request.
  • Technical logs and provider records are retained according to their security purpose and the applicable service configuration.

German retention periods differ by record category. Accounting vouchers are generally retained for eight years, certain books and accounts for ten years, and relevant business correspondence for six years, subject to applicable exceptions and extensions.

Data that must remain archived is restricted to the purposes requiring its retention.

16. Your Data Protection Rights

Subject to the applicable legal conditions, you may request:

  • Access to your personal data.
  • Correction of inaccurate or incomplete information.
  • Erasure of personal data.
  • Restriction of processing.
  • Data portability.
  • Withdrawal of consent.
  • Review of qualifying solely automated decisions, where applicable.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

For direct marketing, you may object at any time, including to profiling connected with that marketing.

Contact info@mirchihouse.com to exercise your rights. We may need proportionate information to verify your identity.

17. Complaints to a Supervisory Authority

You may lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, workplace or the alleged infringement.

For our business in Magdeburg, the relevant state authority is:

Landesbeauftragte für den Datenschutz des Landes Sachsen-Anhalt

Visitor address:
Otto-von-Guericke-Straße 34a
39104 Magdeburg
Germany

Postal address:
Postfach 1947
39009 Magdeburg
Germany

Telephone: +49 391 81803-0
Email: poststelle@lfd.sachsen-anhalt.de
Website: https://datenschutz.sachsen-anhalt.de

18.  Wishlist Function

We use Wishlist by Square to let visitors save products for a later visit. The provider’s privacy notice identifies Appsolve, Grigore Mora 11, Bucharest 011885, Romania.

Providing the wishlist involves processing saved product selections and the identifiers necessary to associate those selections with the relevant visitor or account.

Processing necessary to provide the wishlist you request is based on Article 6(1)(b) GDPR. Where device storage or access is strictly necessary for that requested function, §25(2) TDDDG applies. Any additional analytics or other non-essential tracking requires consent where applicable.

You can manage saved products through the wishlist controls. For questions about your personal data, contact info@mirchihouse.com.

The provider’s privacy contact is legal@square-apps.com.

19. Updates

We update this policy when our services, data-processing activities or legal obligations change. The date above identifies the latest revision.