Privacy policy
Privacy Policy
Thank you for your interest in our online shop. Protecting your personal data matters to us. Below we explain, in accordance with Articles 13 and 14 GDPR, what data we process, for what purpose and on what legal basis.
Our German terms are the binding version. This English text is provided for convenience.
1. Controller
EFP-Line GmbH
Business Unit Cozydunes
Düsseldorfer Str. 75
10719 Berlin
Germany
Represented by Managing Director Audrey Heppner
Phone: +49 30 629 383 77
Email: hello@cozydunes.com
We have not appointed a data protection officer, as the statutory thresholds for doing so are not met. For any data protection question, please use the contact details above.
2. Shop platform and hosting
Our online shop runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes, on our behalf, all data arising when you visit and use the shop, under a data processing agreement pursuant to Art. 28 GDPR.
The data storage location for this shop is set to the European Union.
3. Server log files
When you open our pages, data your browser transmits is recorded automatically: IP address, date and time of the request, the page requested, volume of data transferred, referring page, and browser and operating system details. This is technically necessary to deliver the pages, to keep them stable and secure and to detect misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and uninterrupted operation of the shop.
4. Cookies and consent
We use cookies and comparable technologies. Strictly necessary cookies – for the basket, your language and currency selection and session security – are required to operate the shop; the legal basis is § 25(2) no. 2 TDDDG together with Art. 6(1)(f) GDPR.
All non-essential cookies are set only with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You make that choice through our consent banner, provided by the TinyCookie application. Your choice is stored in a cookie so the banner does not ask again on every visit. You may withdraw your consent at any time with effect for the future by reopening the banner or deleting the cookies in your browser.
5. Usage analysis by Shopify
Shopify collects pseudonymous usage data for us through the cookies _shopify_y and _shopify_s, in order to evaluate how the shop is used – for instance which pages are opened and which items are viewed. This happens only where you have consented; the legal basis is Art. 6(1)(a) GDPR.
We use no third-party analytics or advertising services. In particular, our pages embed no Google Analytics, no Google Tag Manager, no Meta pixel and no other trackers. A review of every network connection made by the shop in August 2026 confirmed this.
6. Processing your order
When you place an order we process the data required for it: name, billing and delivery address, email address, telephone number where given, the items ordered, and payment and order history. The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to perform the purchase contract. Where we must retain data under commercial or tax law, we rely on Art. 6(1)(c) GDPR.
You can order without creating an account. If you do create one, we store the data held there until the account is deleted; the legal basis is Art. 6(1)(b) GDPR.
7. Payment methods
Depending on the payment method you choose, we pass the data needed to process it to the relevant payment provider. In each case the legal basis is Art. 6(1)(b) GDPR.
Cards and wallets (Shopify Payments). Credit and debit cards (Visa, Mastercard, Maestro) as well as Apple Pay and Google Pay are handled through Shopify Payments, for which Shopify International Limited, Dublin, Ireland is responsible. We never receive your full card details – they go directly to the payment provider. Using Apple Pay or Google Pay additionally transmits data to Apple Inc. and Google Ireland Limited respectively.
PayPal. If you pay by PayPal, your data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal is independently responsible for its further processing; PayPal’s own privacy policy applies.
Bank transfer. Where you pay by bank transfer, the payment data is handled by the credit institutions involved.
8. Shipping
To deliver your order we pass your name and delivery address, and where needed for delivery your email address or telephone number, to the carrier commissioned with the shipment. The legal basis is Art. 6(1)(b) GDPR. We will tell you which carrier is used on request; it is also stated in your shipping confirmation.
9. Cancellation
If you declare cancellation of your contract, we process the data you provide in order to handle the cancellation and send you the confirmation required by law. For this we use the Widerruf-Manager application of Händlerbund Management AG, Torgauer Straße 233 B, 04347 Leipzig, Germany, as a processor. The legal basis is Art. 6(1)(b) and (c) GDPR.
10. Contacting us
If you contact us by email, telephone or through a form, we process the data you provide in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries.
11. Newsletter and marketing
We send our newsletter only to recipients who have signed up expressly and confirmed that sign-up by double opt-in. The legal basis is Art. 6(1)(a) GDPR. You can unsubscribe at any time – through the link in every email, or by writing to us. Withdrawal does not affect the lawfulness of processing carried out beforehand.
12. Recipients and processors
Your data reaches only those parties who need it for the purposes described above. In particular:
- Shopify International Limited (Ireland) – shop platform, hosting, payment processing
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – payment processing
- Händlerbund Management AG (Germany) – handling cancellation declarations
- the provider of our consent banner
- the carrier commissioned with the shipment
- our tax adviser and, where legal claims are pursued, lawyers and courts
We have concluded Art. 28 GDPR agreements with all processors. A complete list of our processors is available on request. We do not sell your data.
13. Transfers to third countries
Our shop data is stored within the European Union. Where individual service providers transfer data to countries outside the EU or EEA – for instance group companies of our providers, or the wallet payment providers – this happens only on the basis of an adequacy decision of the European Commission or appropriate safeguards under Art. 44 et seq. GDPR, in particular standard contractual clauses.
14. Retention
We keep personal data only as long as it is needed for the relevant purpose, then delete it unless statutory retention obligations apply. Documents relevant under commercial and tax law are retained for six and ten years respectively under § 257 HGB and § 147 AO. During that period processing is restricted.
15. Your rights
You have the right at any time to:
- access the data held about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal message to hello@cozydunes.com is enough.
16. Right to object
You have the right, on grounds relating to your particular situation, to object at any time to processing of your data carried out on the basis of Art. 6(1)(f) GDPR (Art. 21 GDPR). Where your data is processed for direct marketing, you may object at any time without giving reasons, and we will then stop processing it for that purpose.
17. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
18. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
19. Changes
We update this policy when our processing changes or the law requires it. The version published here applies.
Last updated: August 2026.