Privacy Policy

Last updated: 12 September 2026

1. Who is responsible

The controller for all data processing on this website is:

Anzor Urdia
operating under the trade name PARGULI
c/o flexdienst – #21350
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Deutschland
Email: hello@parguli.com
Phone: +49 152 3796 5844

Questions about your data? Write to us at any time — we answer personally.

2. The short version

We collect the data needed to run this shop and fulfill your order, and we measure how our advertising performs. Beyond the cookies the shop strictly needs to function, nothing runs until you allow it: personalization, marketing and analytics cookies are set only if you consent, you can refuse them without any disadvantage, and you can change your mind at any time through the cookie settings on this site. Your data is never sold, and never shared except where this policy says so.

3. Hosting and shop platform (Shopify)

This shop runs on Shopify. Our contract partner is Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland, which processes personal data on our behalf as a processor under Art. 28 GDPR, on the basis of a data processing agreement.

When you visit any page, Shopify's servers automatically record technical access data (IP address, browser type and version, operating system, referrer URL, date and time of access). We need this to deliver the website reliably and securely; the legal basis is our legitimate interest in the stable and secure operation of the shop (Art. 6(1)(f) GDPR). Log data is not merged with other data. It is stored only for as long as it is needed for these purposes and is then deleted; Shopify's own retention periods apply to the server logs it keeps as our processor.

Shopify may process data on servers outside the EU, in particular in Canada and the United States. These transfers are safeguarded by the European Commission's adequacy decision for Canada, by the EU-US Data Privacy Framework where the receiving entity is certified under it, by the EU Standard Contractual Clauses (2021), and by Shopify's Binding Corporate Rules. Details: Shopify Data Processing Addendum and Shopify Privacy Policy.

4. Cookies and consent

Cookies are small text files stored by your browser. We use Shopify's customer privacy banner to obtain and record your choices. It distinguishes four categories, and everything except the first is off until you allow it.

Required. These make the shop work — they remember your cart, keep your checkout session, store your language and region, and record your cookie decision itself. Examples set by Shopify: _shopify_essential (session and checkout, 1 year), cart (your cart, 2 weeks), localization (2 weeks), _tracking_consent (your cookie choice, 1 year), discount_code (session). They require no consent (§ 25(2) TDDDG); the related data processing rests on Art. 6(1)(b) and (f) GDPR.

Personalization (only with your consent). These remember what you did on the site so that a later visit can be adapted to it, for example the pieces you viewed most recently.

Marketing (only with your consent). These let us measure whether our advertising reaches the right people. They are set by the Meta pixel described in section 9: _fbp (1st party, 3 months), _fbc (set when you arrive from a Meta ad, 3 months), and fr (set by Meta on its own domain, 3 months).

Analytics (only with your consent). Shopify's analytics cookies (_shopify_y, 1 year; _shopify_s, 30 minutes) help us understand how the shop is used — visits, pages viewed, purchases.

Personalization, marketing and analytics cookies are set only after you agree in the cookie banner, on the basis of your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Each category can be accepted or refused separately. You can decline them without any disadvantage, and withdraw your consent at any time through the cookie settings on this site, with effect for the future.

5. Ordering from us

When you place an order we process the data required for the purchase contract: name, email address, delivery and billing address, payment details, and the details of your order (Art. 6(1)(b) GDPR). You are not legally obliged to provide this data — but without it we cannot conclude or fulfill the contract.

We pass data on only where fulfilling your order requires it:

Payment. Payments are handled through Shopify's checkout. Depending on the method you choose:

  • Card payments (Visa, Mastercard, American Express, Maestro, UnionPay), the Apple Pay, Google Pay and Shop Pay wallets, SEPA direct debit, and the local payment methods Bancontact, BLIK, EPS and MobilePay run through Shopify Payments, provided by Shopify International Limited (see section 3), which acts as our processor; the transactions themselves are processed by Stripe Payments Europe, Limited, Ireland.
  • PayPal payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal acts as an independent controller for the payment itself and processes your data under its own privacy policy.
  • If you choose Klarna, the payment is handled by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. We pass Klarna your name, contact details, address, and the order details so that it can process the payment and, for pay-later options, carry out the identity and credit check it requires (Art. 6(1)(b) GDPR). Klarna acts as an independent controller and processes your data under its own privacy policy.

In each case the data needed to complete the payment (your name, address, the order amount, and the payment details you enter) is passed to the provider handling your chosen method. The legal basis is Art. 6(1)(b) GDPR.

Shipping. We give your name, delivery address and — where needed for delivery notifications — your email address or phone number to DHL (Art. 6(1)(b) GDPR).

Fraud prevention. Shopify analyses orders automatically for indications of fraud, using order and device data, and returns a risk assessment to us. The legal basis is our legitimate interest in preventing payment fraud (Art. 6(1)(f) GDPR). The assessment is a recommendation only; any decision about an order is taken by us.

How long we keep it. Order and invoice data is kept for the statutory commercial and tax retention periods (§ 257 HGB, § 147 AO — up to ten years, depending on document type; Art. 6(1)(c) GDPR), then deleted. Data with no retention duty is deleted once the contract is fully performed and warranty periods have run out.

Shop Pay. If you choose to create or use a Shop or Shop Pay account, Shopify processes that account data for its own purposes under its own privacy policy.

6. Customer account

You can order as a guest or use a customer account. The account is provided by Shopify and works with one-time login codes sent by email — no password is stored. Account data (email address, order history, saved addresses) is processed to provide the account (Art. 6(1)(b) GDPR) and deleted when you have the account removed, unless statutory retention periods apply.

7. Contacting us

If you write to us — via the contact form, email, or phone — we process your message and contact details to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to an order or contract, otherwise our legitimate interest in answering inquiries addressed to us (Art. 6(1)(f) GDPR). Messages are deleted once your request is fully dealt with, unless a statutory retention period applies. Contact form submissions are transmitted through Shopify (see section 3) and arrive as email to us.

8. Newsletter

If you sign up for our email list, we use your email address to send you news from PARGULI — new pieces, early access, nothing else. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) UWG).

We use a double opt-in procedure. After you enter your address, we send you one email containing a confirmation link. Your address is added to the list only once you click that link. If you do not confirm, the address is deleted. To prove that consent was given, we store the fact of the sign-up, the confirmation, and the date and time of each, together with the IP address used. This record is kept for as long as the subscription lasts and for the duration of the statutory limitation period afterwards, and is used for no other purpose.

Sending is handled through Shopify's email service (see section 3).

You can unsubscribe at any moment via the link in every email or by writing to hello@parguli.com; your address is then removed from the list. Withdrawing consent does not affect the lawfulness of emails sent before it.

9. Advertising and measurement (Meta)

We advertise on Facebook and Instagram. To understand whether those advertisements work, we use the Meta pixel and the Meta Conversions API, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

What happens. If you consent to marketing cookies, the pixel records how you use this website: pages and products viewed, items added to the cart, and completed purchases, together with technical data such as your IP address, browser and device. The Conversions API sends comparable events from our server rather than from your browser. So that these events can be matched to a Meta account, contact details you provide at checkout, such as your email address, may be transmitted in an irreversibly encrypted (hashed) form. Meta uses this data to report on the performance of our advertising and to show advertising to people whose behaviour resembles that of our customers.

Legal basis. Your consent, given in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Nothing is transmitted before you consent, and you can withdraw your consent at any time through the cookie settings on this site, with effect for the future.

Joint responsibility. For the collection and transmission of this data, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR. We have concluded Meta's controller agreement, under which Meta is responsible for the security of the processing and for handling your rights in respect of the data once it is with Meta. We remain responsible for informing you and for obtaining your consent. The essential content of that agreement and Meta's own information on this processing are available in Meta's Privacy Policy and its Controller Addendum.

Transfers. Meta may process this data in the United States and other countries outside the EU. These transfers are safeguarded by the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified, and additionally by the EU Standard Contractual Clauses.

Your options. Besides withdrawing consent here, you can object to the use of your data for advertising directly in the ad settings of your Facebook or Instagram account, and you can block the pixel with common browser settings or extensions.

10. Our presence on social media

We maintain profiles on Facebook, Instagram and TikTok in order to present our pieces and communicate with people interested in them. When you visit or interact with one of these profiles, the platform processes your personal data under its own responsibility and according to its own privacy policy, including where you are not registered or logged in. We have no influence over that processing and no access to the underlying data.

The platforms are:

  • Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.
  • TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland.

For the statistics the platforms provide us about our profiles (page and profile insights, in aggregated and anonymous form) we are joint controllers with the respective platform under Art. 26 GDPR. We have concluded the agreements the platforms provide for this, under which the platform is primarily responsible for the processing and for handling your rights. We use these statistics on the basis of our legitimate interest in presenting our brand appropriately and improving it (Art. 6(1)(f) GDPR).

If you contact us through one of these platforms, we process your message and profile name to answer you (Art. 6(1)(f) GDPR, or Art. 6(1)(b) where the request concerns a contract). For anything involving your personal data, we recommend contacting us by email rather than through a platform.

The platforms may transfer data to the United States and other countries outside the EU.

11. Your rights

You have the right, under the conditions of the GDPR, to:

  • access the personal data we hold about you (Art. 15),
  • have inaccurate data corrected (Art. 16),
  • have data erased (Art. 17) or its processing restricted (Art. 18),
  • receive the data you provided in a portable, machine-readable format (Art. 20),
  • withdraw any consent at any time, with effect for the future (Art. 7(3)),
  • lodge a complaint with a data protection supervisory authority — for example the authority of your place of residence (Art. 77).

To exercise any of these rights, an informal email to hello@parguli.com is enough.

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation; we will then stop the processing unless compelling legitimate grounds override your interests. If personal data is ever processed for direct marketing, you may object at any time, without giving reasons and free of charge — the data will then no longer be used for that purpose.

12. No automated decision-making

We use no automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR. The fraud assessment described in section 5 is a recommendation; decisions about orders are taken by us.