Privacy policy

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

CHI BRANDS LLC 5830 E 2nd St, Ste 7000 #33420 Casper, Wyoming 82609 United States of America Email: support@chi-drops.com

2. General information on data processing

2.1 Scope of processing personal data

As a rule, we process our users' personal data only to the extent necessary to provide a functioning website along with our content and services. Processing regularly takes place only with the user's consent, or in cases where obtaining prior consent is not possible for practical reasons and processing the data is permitted by law.

2.2 Legal bases

Article 6 (1) (a) GDPR where consent of the data subject is obtained.
Article 6 (1) (b) GDPR for processing necessary to perform a contract to which the data subject is a party.
Article 6 (1) (c) GDPR for processing necessary to comply with a legal obligation.
Article 6 (1) (f) GDPR for processing necessary to protect legitimate interests.

2.3 Data erasure and storage period

The data subject's personal data is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that may take place where provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject (for example commercial and tax retention obligations).

3. Provision of the website and creation of log files

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

Information about the browser type and version used
The user's operating system
The user's internet service provider
The user's IP address
Date and time of access
Websites from which the user's system reaches our website
Websites accessed by the user's system through our website

The legal basis is Article 6 (1) (f) GDPR. Storage takes place for the purpose of delivering the website, system security and technical optimization.

4. Hosting by Shopify

Our online store runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (parent company: Shopify Inc., Canada).

When the store is accessed, technically necessary data (in particular IP address, device and browser information) is transmitted to Shopify. When you place an order, Shopify processes master and order data (name, address, email, payment data, order contents) on our behalf.

Legal basis: Article 6 (1) (b) and (f) GDPR. A data processing agreement under Article 28 GDPR is in place with Shopify. Transfers to third countries (in particular the USA and Canada) take place on the basis of EU standard contractual clauses under Article 46 (2) (c) GDPR.

More information: https://www.shopify.com/legal/privacy

5. Cookies and consent management

We use cookies and comparable technologies on our website. On your first visit you will see a cookie banner where you can consent to or reject cookies and technologies that are not strictly necessary.

Technically necessary cookies (for example cart, session management) are set without consent on the basis of Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6 (1) (f) GDPR.

All other cookies and technologies (marketing, analytics, third-party pixels, session replay) are loaded exclusively after prior express consent under Section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR. You can withdraw your consent at any time through the cookie banner manager in the footer of the website.

6. Customer account and order processing

If you place an order or open a customer account, we collect the following data:

First and last name
Delivery address and billing address
Email address
Phone number, where applicable
Products ordered and order history
Payment data (processed by the respective payment service provider)

The legal basis is Article 6 (1) (b) GDPR (performance of a contract). Data is stored for the duration of the contractual relationship and beyond that within the scope of commercial and tax retention obligations (usually 6 or 10 years).

7. Payment service providers

As part of order processing, payment data is transmitted to the payment service provider you select. We use the following providers:

Shop Pay (Shopify International Ltd., Ireland / Shopify Inc., Canada)
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg)
Klarna (Klarna Bank AB, Sweden)
Credit card payment via Shopify Payments
Apple Pay (Apple Distribution International Ltd., Ireland)
Google Pay (Google Ireland Ltd., Ireland)

The legal basis is Article 6 (1) (b) GDPR. For details of which data is processed, please refer to the privacy notices of the respective provider.

8. Shipping and delivery

To deliver your order, we transmit your name and delivery address to our logistics partner. Shipping takes place from a warehouse in Asia, and delivery in the destination country is usually handled by DHL.

Legal basis: Article 6 (1) (b) GDPR.

9. Newsletter (Klaviyo)

If you subscribe to our newsletter, we process your email address and any other data you provide voluntarily for the purpose of sending marketing communications. Sign-up uses the double opt-in procedure: after signing up you receive a confirmation email, and only after clicking the link it contains is your email address added to the distribution list.

For sending we use Klaviyo, Inc., 125 Summer St, Boston, MA 02110, USA. On our behalf, Klaviyo processes email address, profile and behavioral data (for example open and click rates) to optimize newsletter communication.

The legal basis is Article 6 (1) (a) GDPR. You can withdraw your consent at any time through the unsubscribe link in every newsletter email or by message to support@chi-drops.com.

Transfers to Klaviyo in the USA take place on the basis of the EU-US Data Privacy Framework (Article 45 GDPR) or EU standard contractual clauses (Article 46 (2) (c) GDPR). A data processing agreement is in place.

More information: https://www.klaviyo.com/legal/privacy-policy

10. Web analytics, tracking and marketing

The following tools are loaded exclusively after prior consent through our cookie banner (Article 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG).

10.1 Meta Pixel (Facebook/Instagram)

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

We use the Meta Pixel for marketing and analytics purposes. Through the pixel, information about your use of our website (for example pages visited, purchases, cart actions) is transmitted to Meta. This information can be linked to your Meta account and used for personalized advertising and reach measurement.

Data is transferred to the USA on the basis of the EU-US Data Privacy Framework and EU standard contractual clauses.

10.2 Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Microsoft Clarity records session recordings, click, scroll and movement data to optimize the user experience. IP addresses are processed in truncated form, and entries in form fields are generally masked.

Data is transferred to Microsoft in third countries (in particular the USA) on the basis of the EU-US Data Privacy Framework and EU standard contractual clauses.

10.3 Blotout (server-side tracking)

Provider: Blotout, Inc., 1390 Market St, San Francisco, CA 94102, USA.

Blotout enables server-side, privacy-compliant tracking. Through the conversion API, selected events (for example purchases, add-to-cart actions) are processed and forwarded to advertising and analytics platforms. Sensitive data is transmitted in hashed form.

Data is transferred to the USA on the basis of EU standard contractual clauses. A data processing agreement is in place.

10.4 OneTrack

Provider: OneTrack (provider according to their website; address to be specified here where applicable).

OneTrack provides server-side conversion and attribution tracking for Shopify stores. Order and behavioral data is processed to measure advertising effectiveness.

Transfers to third countries (in particular the USA) take place on the basis of appropriate safeguards under Article 46 GDPR. A data processing agreement is in place.

10.5 Judge.me (product reviews)

Provider: Judge.me (Webnova OÜ, Roosikrantsi tn 2-1226, 10119 Tallinn, Estonia).

If you submit a product review or are invited by email to leave one, Judge.me processes your name, email address, order and the content of your review on our behalf.

Legal basis for the post-purchase review request: Article 6 (1) (f) GDPR (legitimate interest in customer feedback) and Section 7 (3) of the German Unfair Competition Act. You can object to this use at any time by email to support@chi-drops.com.

11. Transfers to third countries

We expressly point out that in the course of the processing described above, personal data is transferred to the USA and possibly to other third countries outside the European Economic Area, including to our own company (CHI BRANDS LLC, Wyoming, USA) and to the service providers named.

Appropriate safeguards under Articles 44 ff. GDPR are in place for these third-country transfers:

the adequacy decision of the EU Commission regarding the EU-US Data Privacy Framework (where the respective recipient is certified),
EU standard contractual clauses under Article 46 (2) (c) GDPR,
supplementary technical and organizational protective measures.

Despite these measures, the level of protection in the USA is generally lower than the EU data protection standard, particularly with regard to access by government authorities. Enforcing data subject rights may be more difficult.

12. Rights of the data subject

You have the following rights against us regarding personal data relating to you:

Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object (Article 21 GDPR)
Right to withdraw consent given (Article 7 (3) GDPR) with effect for the future.

To exercise your rights, please contact support@chi-drops.com.

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Article 77 GDPR). In Germany, the competent authority depends on the federal state in which you reside; you can find a list at https://www.bfdi.bund.de.

13. Right to object to direct marketing

Where your personal data is processed on the basis of legitimate interests under Article 6 (1) (f) GDPR, you have the right under Article 21 GDPR to object to the processing, where grounds arise from your particular situation or where the objection is directed against direct marketing. In the latter case you have a general right to object, which is implemented without you having to state a particular situation.

14. Data security

During your visit to the website we use the widely used SSL and TLS procedure in combination with the highest level of encryption supported by your browser.

15. Currency and changes to this privacy policy

This privacy policy is currently valid and dated [date]. As our website develops further, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy.

Last updated: May 1, 2026