Privacy Policy

This policy explains which personal data the Lienda Shop app (Android and iOS) and this website process, for what purpose, on which legal basis and for how long. It follows the General Data Protection Regulation (GDPR).

1. Controller

No data protection officer has been appointed, as the statutory conditions for appointing one are not met.

2. Overview: what we process and why

3. Account and sign-in

Sign-in uses an email address and password only. Authentication runs on Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Firebase stores your password as a hash; we never see it in clear text. No social sign-in is offered.

Account data, addresses, orders and points balances are stored in Cloud Firestore, and uploaded files in Cloud Storage for Firebase — both operated by Google Ireland Limited.

4. Orders and payments

PayPal and card payments

PayPal payments and credit/debit card payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. Card payments technically run through the PayPal Orders API. Your full card details are handled by PayPal and are not stored by us; we only receive the transaction ID, the amount and the payment status. After paying, PayPal redirects you back to liendamarket.de/return or liendamarket.de/cancel. PayPal's own privacy policy applies in addition.

Klarna

For purchase on account and instalments we use Klarna. The data required for that payment method is transmitted to Klarna. Klarna may carry out its own identity and credit checks and acts as an independent controller for them; Klarna's privacy notice applies.

Bank transfer

If you pay by bank transfer we process the details of the incoming payment (name, IBAN, reference) in order to match it to your order.

5. Country detection (ip-api.com)

What is sent is your device's IP address; what comes back is the detected country. We keep the result only for the session and do not use it for profiling. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing you the shipping options valid for your country immediately. The provider is ip-api.com and processing may take place outside the EU (see section 13). You can change the delivery country manually in the app at any time.

6. Push notifications

For notifications about your order (payment received, dispatch, cancellation) we use Firebase Cloud Messaging. A push token is assigned to your device and stored together with the order record so the notification reaches the right device. You can switch push notifications off at any time in your operating system settings.

7. Analytics (Meta App Events)

The app includes the Facebook App Events SDK from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It measures events such as app launches, product views and completed purchases so we can understand app usage and attribute advertising. Device information and advertising identifiers may be transmitted to Meta. The legal basis is your consent under Art. 6(1)(a) GDPR; on iOS, consent is additionally requested through App Tracking Transparency. You can withdraw consent at any time with effect for the future in your device settings.

8. Product images (Cloudinary)

Product images are delivered through Cloudinary. When an image loads, your device transmits technically necessary connection data — in particular your IP address — to the provider. Legal basis: Art. 6(1)(f) GDPR (reliable, fast image delivery).

9. Email

We send order confirmations, dispatch notices and cancellation notices by email through an SMTP service. This processes your email address, your name and the order data. Legal basis: Art. 6(1)(b) GDPR.

10. Data stored on your device

The app stores your basket contents and your language preference (German, English or Arabic) locally on your device. This data stays on the device and is removed when you uninstall the app or clear its data.

11. This website

This website consists of static pages. It sets no advertising or analytics cookies and loads no external fonts, maps or scripts. The only thing stored in your browser is the language version you chose, so that your next visit opens in the same language. When pages are requested, the hosting provider processes technically necessary connection data (IP address, time, file requested) in server log files; legal basis Art. 6(1)(f) GDPR.

12. Recipients and processors

• Google Ireland Limited — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging (processor)
• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing (own responsibility)
• Klarna — purchase on account and instalments (own responsibility)
• ip-api.com — delivery country detection from the IP address
• Meta Platforms Ireland Limited — app analytics and attribution
• Cloudinary — product image delivery
• Carriers DHL, DPD and Hermes — delivery of your order (name, delivery address and, where applicable, email or phone number for delivery notifications)
• SMTP / mail provider — sending order emails
• Tax advisers and authorities — where legally required

Processor agreements under Art. 28 GDPR are in place. We do not sell personal data.

13. Transfers outside the EU

Some services may process data outside the European Union, in particular in the USA (Google LLC as part of the Google group, Meta Platforms, Cloudinary) and, in the case of ip-api.com, at its server locations. Transfers are based on an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the provider is certified) or on standard contractual clauses under Art. 46(2)(c) GDPR together with supplementary measures. Despite these measures, access by authorities in the third country cannot be ruled out in every case.

14. Retention

• Account data: until you delete your account (see section 16).
• Order and invoice data: up to 10 years, due to German commercial and tax retention rules (§ 147 AO, § 257 HGB).
• Push tokens: until withdrawal, uninstallation or token expiry.
• Support correspondence: normally up to 3 years after the case is closed.
• Website server logs: short term, usually days to weeks.

15. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability in a common, machine-readable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent with effect for the future (Art. 7(3))

An informal message to alhamada.shop@gmail.com is enough. We reply within the statutory period of one month and may ask you to verify your identity first.

16. Deleting your account

17. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

18. Changes to this policy

We update this policy when the app, the services used or the legal situation change. The version published on this page applies; the date at the top shows the current status.