Privacy Policy

Privacy Policy 

Last updated: 19 August 2026

This Privacy Policy explains how Roma Magnifica GbR collects, uses, stores and shares personal information when you visit roma-magnifica.com, create a customer account, place an order, contact us or otherwise interact with our online store.

Depending on where you are located, additional mandatory privacy rights under your local law may apply.

1. Controller

The controller responsible for the processing of personal data in connection with this online store is:

Roma Magnifica GbR
c/o POSTFLEX PFX-589-629
Emsdettener Straße 10
48268 Greven
Germany

Email: magnifica.roma@web.de

2. Personal Data We Process

Depending on how you use our store, we may process the following categories of personal data:

  • first and last name;

  • billing address;

  • shipping address;

  • email address;

  • telephone number, where provided;

  • customer account information;

  • order history;

  • products ordered;

  • shopping cart information;

  • order numbers and order status;

  • payment and transaction information;

  • shipping and fulfilment information;

  • return, refund and complaint information;

  • communications with us;

  • IP address;

  • device information;

  • browser type and operating system;

  • approximate location derived from technical information;

  • cookie and consent information;

  • information about your interaction with our store.

We do not require you to provide more personal data than is reasonably necessary for the relevant purpose.

3. Purposes and Legal Bases of Processing

Where the General Data Protection Regulation (“GDPR”), UK GDPR or comparable laws apply, we process personal data on one or more of the following legal bases:

Performance of a contract

We process personal data where necessary to:

  • process an order;

  • accept and process payment;

  • deliver goods;

  • manage customer accounts;

  • provide order information;

  • process returns;

  • handle complaints;

  • provide replacement deliveries;

  • process refunds; and

  • otherwise perform the purchase contract.

For persons covered by the GDPR, the legal basis is generally Article 6(1)(b) GDPR.

Compliance with legal obligations

We process and retain information where necessary to comply with legal obligations, including accounting, taxation, commercial record-keeping, fraud prevention and regulatory requirements.

For persons covered by the GDPR, the legal basis is generally Article 6(1)(c) GDPR.

Legitimate interests

Where permitted by law, we may process information where necessary for legitimate interests such as:

  • operating and securing our online store;

  • preventing fraud and misuse;

  • maintaining IT security;

  • improving business processes;

  • managing and documenting transactions;

  • responding to general enquiries; and

  • asserting, exercising or defending legal claims.

For persons covered by the GDPR, the legal basis is Article 6(1)(f) GDPR, provided that our interests are not overridden by the interests, fundamental rights or freedoms of the person concerned.

Consent

Where consent is required by applicable law, in particular for certain cookies, tracking technologies, personalised advertising or similar processing, we process data only after the required consent has been obtained.

For persons covered by the GDPR, the legal basis is Article 6(1)(a) GDPR.

Consent may be withdrawn at any time with effect for the future.

4. Shopify

Our online store is hosted and operated using the ecommerce platform Shopify.

For customers located in the European Economic Area, United Kingdom and Switzerland, personal data is initially processed by Shopify International Limited, Ireland.

Shopify processes information necessary to provide our online store and associated services. Depending on how you interact with the store, this may include:

  • contact information;

  • customer account information;

  • order information;

  • transaction information;

  • payment-related information;

  • IP addresses;

  • browser and device information;

  • activity and interaction information;

  • cookie and consent information.

Shopify may use affiliated companies and third-party service providers to provide its services.

Personal information may therefore be processed in countries other than the country in which you live.

For its standard ecommerce services, Shopify generally processes customer personal data on our behalf where Shopify acts as our processor or service provider.

For certain additional services described below, Shopify may act independently as a controller or business under applicable privacy laws.

Shopify Network Intelligence and Enhanced Services

We have Shopify Network Intelligence enabled.

This allows Shopify to securely use certain customer information from interactions and transactions with our store together with information from interactions with Shopify and other Shopify merchants in order to provide enhanced services.

These services may include, depending on the Shopify features used:

  • analytics;

  • fraud prevention;

  • product and store personalisation;

  • improved store performance;

  • recommendations;

  • advertising measurement;

  • advertising personalisation; and

  • other features intended to protect, improve and grow Shopify-powered businesses.

For these Enhanced Services, Shopify may process personal information as an independent controller or business under applicable privacy laws.

Information submitted through our store may therefore be shared with Shopify and other service providers, including providers located in countries other than your country of residence, where necessary to provide these services.

More information about Shopify's independent processing of customer information and the privacy rights available directly against Shopify can be found in the Shopify Consumer Privacy Policy.

When adding this Privacy Policy to Shopify, the words “Shopify Consumer Privacy Policy” should be linked to Shopify's current Consumer Privacy Policy.

Your privacy choices relating to Shopify

Where required by applicable law, you may object to or opt out of certain uses of your personal information, including processing that may constitute the “sale” or “sharing” of personal information or processing for targeted advertising under applicable US state privacy laws.

Where available in your region, you can exercise these choices through the “Your Privacy Choices” / Data Sharing Opt-Out function provided in our store.

Where supported by applicable law and our Shopify privacy configuration, recognised signals such as the Global Privacy Control (GPC) may also be respected.

For visitors in jurisdictions requiring prior consent, Shopify Network Intelligence respects applicable consent choices communicated through Shopify's customer privacy tools.

5. Cookies and Similar Technologies

Our store uses cookies and similar technologies.

Some technologies are necessary for the operation of the store and may be used for purposes such as:

  • maintaining shopping cart functionality;

  • processing checkout;

  • account authentication;

  • security;

  • fraud prevention;

  • remembering privacy choices; and

  • providing functions expressly requested by the visitor.

Other technologies may be used for analytics, personalisation or advertising only where permitted under applicable law.

For visitors in regions where prior consent is required, we use Shopify's automated customer privacy settings and cookie banner.

Where German law applies, non-essential access to or storage of information on a user's device is carried out only where the requirements of applicable privacy law, including Section 25 TDDDG, are met.

You can change or withdraw applicable cookie and privacy choices through the privacy controls made available in our store.

6. Analytics and Customer Events

Shopify provides analytics and reporting functions that allow us to understand how our store is used and how orders and transactions are completed.

These functions may process technical and interaction information such as:

  • store visits;

  • pages viewed;

  • device and browser information;

  • approximate location;

  • interaction with products;

  • shopping cart activity; and

  • completed transactions.

Where consent is legally required for non-essential analytics or similar technologies, such processing is subject to the consent choices made through our cookie banner.

At the date of this Privacy Policy, we have not configured additional custom or app pixels such as Meta Pixel, TikTok Pixel or Google advertising pixels through Shopify Customer Events.

If we introduce additional advertising or tracking technologies in the future, this Privacy Policy will be updated as required.

7. Customer Accounts

Our store offers Shopify customer accounts.

If you use a customer account, Shopify may process information necessary to authenticate you and provide the account functionality, including:

  • your email address;

  • authentication information;

  • profile information;

  • shipping information;

  • order history; and

  • account activity.

Customer accounts allow customers to access and manage information relating to their purchases and account.

Processing necessary to provide the requested customer account is based, where the GDPR applies, primarily on Article 6(1)(b) GDPR.

8. Orders and Checkout

When you place an order, we process the personal information necessary to conclude and fulfil the purchase contract.

This includes, depending on the order:

  • name;

  • billing address;

  • delivery address;

  • email address;

  • telephone number, where provided;

  • products and quantities ordered;

  • order value;

  • payment method;

  • payment status;

  • shipping details; and

  • information necessary to process returns, refunds or complaints.

Mandatory information is required because without it we may not be able to process or deliver the order.

9. Fulfilment and Shipping Partner – Kardonas GmbH

We use Kardonas GmbH as a fulfilment and shipping partner for relevant orders.

Products may be stored, prepared, packaged and dispatched directly to customers by Kardonas GmbH.

For this purpose, Kardonas GmbH receives the personal information required to fulfil the relevant order.

This may include:

  • customer's first and last name;

  • delivery address;

  • products ordered;

  • quantities;

  • order or reference information;

  • delivery instructions;

  • telephone number or email address where reasonably required for delivery or order handling.

Kardonas GmbH may also receive information necessary to process:

  • physical returns;

  • incorrect deliveries;

  • damaged products;

  • complaints; and

  • replacement shipments.

The purpose of this disclosure is solely to enable the proper fulfilment and handling of customer orders and related contractual obligations.

Where the GDPR applies, such disclosure is generally based on Article 6(1)(b) GDPR.

Roma Magnifica GbR remains the customer's contractual point of contact for purchases made through our online store.

10. Delivery through DHL

Orders may be delivered using companies of the DHL Group, in particular DHL parcel services.

For delivery purposes, the information required by the carrier may be transmitted to DHL either by us or by our fulfilment partner.

This can include:

  • recipient name;

  • delivery address;

  • package and shipment information;

  • tracking information; and

  • where necessary for the requested delivery service, email address or telephone number.

The purpose of this processing is the delivery and tracking of ordered goods.

Where the GDPR applies, the transfer of information necessary for ordinary delivery is generally based on Article 6(1)(b) GDPR.

Where additional carrier services require separate consent under applicable law, the relevant information will only be transmitted where the necessary legal requirements have been met.

11. Payments and Shopify Payments

We use Shopify Payments for payment processing.

Depending on the customer's country, device and checkout configuration, payment options may currently include:

  • Shop Pay;

  • Visa;

  • Mastercard;

  • American Express;

  • Maestro;

  • UnionPay;

  • Apple Pay; and

  • Google Pay.

Not every payment method is necessarily available to every customer or in every country.

When a payment is made, information required for the transaction may be processed by Shopify, the relevant payment processor, card network, bank or digital wallet provider.

This may include:

  • name;

  • billing information;

  • transaction amount;

  • currency;

  • order reference;

  • selected payment method;

  • transaction status;

  • device or security information; and

  • fraud-prevention information.

Payment information is processed to complete the transaction, prevent fraud and comply with applicable payment and financial regulations.

Where the GDPR applies, processing necessary for payment is generally based on Article 6(1)(b) GDPR and, where legal obligations apply, Article 6(1)(c) GDPR.

Processing for fraud and security purposes may additionally be based on legitimate interests pursuant to Article 6(1)(f) GDPR, where applicable.

Where you choose services such as Apple Pay or Google Pay, the respective provider may additionally process information under its own privacy terms.

12. Lexware Office and Accounting

We use Lexware Office for accounting and document management.

Our Shopify store is connected to Lexware Office using the Lexware Office+ (lexoffice) Shopify application provided by Appify.

The integration may process or transfer information relating to Shopify orders in order to automate accounting processes and generate or manage documents such as:

  • invoices;

  • credit notes;

  • delivery documents;

  • accounting records; and

  • transaction records.

Depending on the transaction, processed information may include:

  • name;

  • email address;

  • telephone number;

  • postal address;

  • customer information;

  • order information;

  • payment and transaction information;

  • tax information; and

  • information necessary for accounting documents.

Lexware Office is operated by Haufe-Lexware GmbH & Co. KG, Germany.

We use these services to fulfil our statutory bookkeeping, accounting and tax obligations and to manage our commercial records efficiently.

Where the GDPR applies, processing is primarily based on Article 6(1)(c) GDPR where required by statutory accounting or tax obligations and, where applicable, Article 6(1)(f) GDPR for efficient business administration.

13. MS Order Printer – PDF Invoice

We use the Shopify application MS Order Printer – PDF Invoice, provided by Magestore, to generate and manage order-related documents.

The application may be used to create or process documents such as:

  • invoices;

  • receipts;

  • packing slips;

  • refund documents;

  • return documents;

  • credit notes; and

  • other order documentation.

To provide these functions, the application may access customer and order information including, where applicable:

  • name;

  • email address;

  • telephone number;

  • postal address;

  • order history;

  • products ordered;

  • fulfilment information;

  • returns information;

  • transaction-related information; and

  • technical device or activity information.

Magestore is based in Vietnam. Depending on the technical provision of the service, processing may therefore involve countries outside the European Economic Area.

Where international transfers are subject to the GDPR or comparable laws, such transfers may take place only in accordance with the applicable requirements governing international transfers.

14. Communications

We do not currently operate a separate promotional newsletter.

If you contact us directly by email, we process the information you provide in order to respond to your message.

This may include:

  • your name;

  • email address;

  • order number;

  • contents of your message; and

  • other information voluntarily provided by you.

Where your enquiry relates to an order or prospective purchase, processing is generally based on Article 6(1)(b) GDPR.

For other enquiries, processing may be based on our legitimate interest in responding to customer and business communications pursuant to Article 6(1)(f) GDPR.

If we introduce email, SMS or other direct marketing in the future, such communications will be sent only in accordance with applicable marketing and privacy laws, including consent requirements where applicable.

15. Fraud Prevention, Security and Abuse Prevention

We and our service providers may process technical, transaction and account information where necessary to:

  • protect customer accounts;

  • prevent fraudulent transactions;

  • detect suspicious activity;

  • prevent misuse;

  • secure our store;

  • investigate security incidents; and

  • enforce legal rights.

Where the GDPR applies, such processing may be based on Article 6(1)(f) GDPR, namely our legitimate interests and those of our customers and service providers in maintaining a secure ecommerce environment.

Where processing is required by law, Article 6(1)(c) GDPR may apply.

16. Recipients of Personal Data

Depending on the circumstances, personal information may be disclosed to or processed by the following categories of recipients:

  • Shopify and Shopify affiliated companies;

  • Shopify subprocessors;

  • Shopify Payments and payment processors;

  • banks, payment networks and wallet providers;

  • Kardonas GmbH;

  • DHL and other carriers where necessary;

  • Appify;

  • Lexware Office / Haufe-Lexware GmbH & Co. KG;

  • Magestore in connection with MS Order Printer;

  • IT and hosting providers;

  • accountants, tax advisers or other professional advisers;

  • public authorities, courts or regulators where disclosure is legally required; and

  • other service providers where necessary to operate our business and permitted by law.

We do not disclose personal information to unrelated third parties without a lawful purpose or other valid legal basis.

17. International Transfers of Personal Data

Because we operate an international online store and use international technology and payment providers, personal information may be processed outside the country in which a customer lives.

This may include processing outside the European Economic Area.

For EEA, UK and Swiss customers, Shopify states that customer personal data is initially processed by Shopify International Limited in Ireland and may subsequently be processed by Shopify affiliates and subprocessors in other countries.

Where the GDPR or comparable international transfer rules apply, international transfers are made only where the relevant legal requirements are met.

Depending on the destination and provider, this may include:

  • an applicable adequacy decision;

  • appropriate contractual safeguards;

  • Standard Contractual Clauses;

  • other legally recognised safeguards; or

  • an applicable statutory exception.

18. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

The actual retention period depends on the type of information and the reason for processing.

In particular, order, invoice, accounting and transaction information may need to be retained for statutory commercial and tax retention periods.

Information may also be retained where necessary to:

  • establish, exercise or defend legal claims;

  • resolve disputes;

  • prevent fraud;

  • comply with legal obligations; or

  • enforce contractual rights.

Once information is no longer required and no statutory retention obligation or other lawful basis applies, it will be deleted or otherwise handled in accordance with applicable law.

19. Rights of Persons in the EEA, United Kingdom and Switzerland

Where the GDPR, UK GDPR, Swiss data protection law or comparable legislation applies, you may have rights including the right to:

  • request access to personal data concerning you;

  • request correction of inaccurate or incomplete information;

  • request deletion of personal data;

  • request restriction of processing;

  • receive certain personal data in a structured, commonly used and machine-readable format;

  • request transmission of eligible data to another controller where technically feasible;

  • object to processing based on legitimate interests;

  • object to certain direct marketing;

  • withdraw consent at any time where processing is based on consent; and

  • lodge a complaint with a competent data protection supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Certain rights are subject to statutory conditions and exceptions.

20. Privacy Rights in the United States

Residents of certain US states may have additional rights under applicable state privacy laws.

Depending on the state and the circumstances, these rights may include:

  • the right to know or access personal information;

  • the right to request correction;

  • the right to request deletion;

  • the right to obtain a portable copy of certain information;

  • the right to opt out of certain sales or sharing of personal information;

  • the right to opt out of targeted advertising;

  • the right to limit certain uses of sensitive personal information where applicable;

  • the right not to receive unlawful discriminatory treatment for exercising privacy rights; and

  • where provided by applicable law, the right to appeal a decision concerning a privacy request.

Because Shopify Network Intelligence is enabled, certain processing by Shopify may qualify as “sharing” or “targeted advertising” under some US state privacy laws.

Where required in your jurisdiction, you can exercise the relevant opt-out right through the “Your Privacy Choices” / Data Sharing Opt-Out mechanism provided in our store.

You may also exercise certain rights directly in relation to Shopify's independent processing through Shopify's privacy services.

21. Rights in Other Countries

We sell to customers internationally.

If you live outside the European Economic Area, United Kingdom, Switzerland or United States, you may have additional privacy rights under the laws of your country or region.

Nothing in this Privacy Policy is intended to restrict mandatory privacy rights that apply to you under local law.

Where applicable, requests may be submitted using the contact information provided below.

22. Exercising Your Privacy Rights

To exercise a privacy right in relation to processing for which Roma Magnifica GbR is responsible, please contact:

Roma Magnifica GbR
c/o POSTFLEX PFX-589-629
Emsdettener Straße 10
48268 Greven
Germany

Email: magnifica.roma@web.de

We may need to verify your identity before processing certain privacy requests.

We will respond in accordance with the time limits and requirements of applicable law.

Where your request concerns processing carried out independently by Shopify, you may also be able to exercise your rights directly through Shopify's privacy mechanisms.

23. Automated Decision-Making

We do not ourselves make decisions producing legal effects concerning customers solely on the basis of automated processing without human involvement unless such processing is permitted by applicable law and the required information and safeguards are provided.

Our payment, ecommerce and security service providers may use automated systems for purposes such as fraud detection, security and payment authorisation in accordance with their respective legal obligations and privacy terms.

24. Security

We take appropriate technical and organisational measures intended to protect personal information against:

  • unauthorised access;

  • unlawful processing;

  • accidental loss;

  • alteration;

  • disclosure; and

  • destruction.

No internet-based system can, however, guarantee absolute security.

25. Changes to this Privacy Policy

We may update this Privacy Policy if:

  • our business processes change;

  • we introduce new apps or services;

  • payment or fulfilment arrangements change;

  • we introduce new analytics or advertising technologies; or

  • applicable legal requirements change.

The version currently published in our online store applies.

Where required by law, material changes will be communicated or additional consent will be obtained.

26. Contact

For questions about this Privacy Policy or the processing of your personal information, please contact:

Roma Magnifica GbR
c/o POSTFLEX PFX-589-629
Emsdettener Straße 10
48268 Greven
Germany

Email: magnifica.roma@web.de