What we process, what for, and for how long
Privacy policy
This policy sets out which personal data arises when you use shukchok.com, what happens to it, and what rights you have. It covers visiting the website, registering, ordering, and using your account.
Controller
The controller for this processing is EazyClean Technologies GmbH, Doncaster Platz 5, 45699 Herten, Germany.
For questions about data protection and to exercise your rights, reach us at info@shukchok.com or by telephone on +49 2366 5695108. Full company details are set out in the legal notice.
No data protection officer has been appointed; the conditions of § 38(1) BDSG are not met. That changes nothing about your rights and nothing about the competence of the supervisory authority.
What data we process
We collect only what the respective purpose requires. Depending on how you use the shop, that is:
- Master data: company, name, address, e-mail address, telephone number
- Contract data: items ordered, prices, billing and delivery address, payment method, order history
- Account data: credentials, settings, saved addresses, your declaration of trader status with a timestamp
- Communication data: the content of your enquiries to us, with dates
- Usage data: pages and items opened, time spent — only with your consent to the Analytics category
- Access data: IP address, time, resource requested, status code, browser identification
Where the data comes from
From three sources and no others: what you tell us yourself when registering, ordering or enquiring; what your device transmits technically on access; and what a supplier reports back to us to fulfil your order, such as a tracking number.
We do not buy in address lists and obtain no data from data brokers, online directories or data marketplaces.
Purposes and legal bases
There is no automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR. There is no credit scoring and no automatic rejection of orders based on an assessment of your person.
- 1.Performance of the contract — order, delivery, invoice, warranty, queries. Basis: Art. 6(1)(b) GDPR. Without this data no contract can come about.
- 2.Customer account — sign-in, saved addresses, order overview. Basis: Art. 6(1)(b) GDPR.
- 3.Security — detecting and averting disruption, automated access and abuse. Basis: Art. 6(1)(f) GDPR. Our legitimate interest is the undisturbed operation of the shop.
- 4.Statutory retention — commercial and tax obligations. Basis: Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.
- 5.Analytics and advertising — evaluating usage, measuring advertising performance. Basis: your consent, Art. 6(1)(a) GDPR, revocable for the future. Without it only the counting of page views in aggregate figures remains, with no cookie and no identifier — for that, Art. 6(1)(f) GDPR, to which you may object.
Access logs
Every request is logged — IP address, time, resource requested, status code, browser identification. This serves to detect and avert disruption and abuse.
Who we pass data to
Data is passed on only where the respective purpose requires it or you have consented. Recipients are:
- Shopify International Ltd. (Ireland) — operation of the catalogue, cart, checkout and customer account
- Payment service providers — handling the payment method you chose
- Suppliers on the marketplace — for intermediated goods, the details required for dispatch and queries. Delivery is not possible without them.
- Carriers and customs agents — address and contact details, plus the details required for the customs declaration on export
- Hetzner Online GmbH (Germany) — operating our own server. Quotes, invoices and contact requests are produced there, and the product view counts live there too.
- IONOS SE (Germany) — sending our email: order and quote confirmations, invoices, replies to contact requests
- Cloudflare — protection of the sign-in and registration forms against automated access
- Google Ireland Ltd. or Fresenius Umwelttechnik — only if you choose to sign in with an account held there. Your identifier, name and email address from that account are then transmitted.
- Google Ireland Ltd. — audience measurement and advertising; which data flows with and which without your consent is set out in the cookie policy
- Microsoft Corporation (United States) — session recording with Microsoft Clarity; without your consent with no cookies and no recognition
- Tax advisers and authorities — where we are legally obliged
Transfers to third countries
If you order to a country outside the EU, we transmit the details required for dispatch and the customs declaration there. That is necessary for performance of the contract (Art. 49(1)(b) GDPR).
With the services from Google, data is also transferred to Google LLC in the United States, and with Microsoft Clarity to Microsoft Corporation there as well. This does not begin only with your consent: the notice that a page was opened, carrying no identifier, goes there too. In both cases the basis is the European Commission’s standard contractual clauses and the adequacy decision for the EU-US Data Privacy Framework.
How long we store data
We store personal data only for as long as the purpose for which it was collected requires — unless longer retention is legally prescribed.
| Data | Period | Reason |
|---|---|---|
| Purchase-related data, invoices | 10 years | § 147 AO, § 257 HGB |
| Commercial letters, order correspondence | 6 years | § 257(4) HGB |
| Customer account | until you delete it | contractual relationship |
| Access logs | short term | disruption and abuse defence |
| Record of consent | for as long as the duty to demonstrate lasts | Art. 7(1) GDPR |
Your rights
Under Articles 15 to 21 GDPR you have the following rights:
- Access to the data we process about you (Art. 15)
- Rectification of inaccurate or incomplete data (Art. 16)
- Erasure, where no retention obligation stands in the way (Art. 17)
- Restriction of processing (Art. 18)
- Data portability in a common format (Art. 20)
- Objection to processing that rests on a legitimate interest (Art. 21)
Withdrawal and complaints
You may withdraw consent at any time, with effect for the future. For cookies the cookie dialog suffices; for everything else a message to info@shukchok.com. The lawfulness of processing up to that point is unaffected.
Independently of this, you have the right to lodge a complaint with a data protection supervisory authority, Art. 77 GDPR — at your place of residence, your place of work, or the place of the alleged infringement. For our seat, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia is competent.
Other processing in the shop
Some of this is barely noticeable, which is precisely why it is set out here.
- We count product views ourselves, on our own server and without a cookie. So that the same person is not counted again on every reload, we form a salted checksum from your IP address, your browser identification, the product and the date. It cannot be reversed, it is a different value the next day, and it is deleted after two days. What remains is one number per product per day. The basis is our legitimate interest in reliable usage figures (Art. 6(1)(f) GDPR).
- Your saved-items list stays in your browser alone. It never reaches our server, and we do not know what is in it.
- The shop assistant answers questions from a stored knowledge base. Your question is transmitted to Shopify for that and logged there. Please do not put personal details into it — for matters concerning you personally, the contact form is the right route.
- Reviews and product questions are published under the name you give with them. They are visible to everyone and findable through search engines.
- Quotes and invoices are produced as PDFs on our server. They carry your company and billing details and are retained for the periods required by commercial and tax law.
Audience measurement and advertising
If you agree to the Analytics category, we measure how the shop is used with Google Analytics 4: which pages and products are opened, which terms are searched, which items go into the cart and which orders are completed. From that we learn where information is missing — not who you are.
Google receives a randomly assigned identifier from a cookie. If you are signed in, your customer number is added: an internal number without name or address. It serves to recognise your visits across devices as one journey rather than several strangers.
If you also agree to the Advertising category, we pass Google your email address as a hash — a checksum that cannot be reversed, never the address itself. Google uses it to match a completed purchase to the original ad click when the cookie is missing. Only with that same agreement does Google evaluate signals from signed-in Google accounts and derive age group, gender and interests as aggregates.
Microsoft Clarity also runs on our pages. It records how your visit unfolds — mouse movement, clicks, scroll depth — so that we can see where our pages get in the way. Customer account, address book, orders and quotes are blacked out in those recordings. The provider is Microsoft Corporation. If you are signed in and have agreed to the Analytics category, we carry the same customer number there as with Google — so that the recording belonging to a given transaction can be found.
Without your agreement no cookies are set and no identifiers are transmitted. That does not switch the services off: Google still receives notice that a page was opened, and Clarity still records without recognising you. Each page view then stands on its own — with no link to you and none to your other views. The legal basis for that is our legitimate interest in audience measurement in aggregate figures (Art. 6(1)(f) GDPR); you may object to it at any time.
Everything beyond that happens solely with your consent (Art. 6(1)(a) GDPR): cookies, recognition across pages and visits, cart and order data, the transmission of your customer number and of the hashed email address. You can change your decision at any time in the cookie settings.
Google deletes the event data collected this way after 14 months.
Cookies and comparable techniques
Necessary cookies are set without consent; anything beyond that only with your agreement. Which cookies those are, on what basis they are set, and how to change your decision is set out in the cookie policy. That is the governing text for it; only the reference stands here, deliberately.
Relationship to the terms and conditions
This policy does not form part of the terms and conditions. The choice of law made there does not extend to it: data protection is mandatory law and is not open to a choice of law.
The GDPR applies to the processing. For consent and tracking, the law of the country you access from applies alongside it — in Germany § 25 TDDDG. The split is by subject matter, not by person: tracking at the place of market, contract data at our seat.
No services for children
shukchok.com is addressed exclusively to traders and not to children. We do not knowingly collect data from children. Should such data nevertheless have reached us, we delete it on notice to info@shukchok.com.
Links to external websites
This website links in places to external offerings, for example to manufacturers or to a service provider’s privacy policy. We are not responsible for their content or their handling of data; their own policies apply there.
Changes to this policy
We adapt this policy when the legal position or our processing changes. The version that stands on this page at the time of your visit is the governing one; the date is shown above.