Privacy Policy

This website is operated by:

Gluzov Ievgen  
Sole trader (Einzelunternehmer) 
Trading as MCGJ 
Operating under the brand name Armbēag Heritage 
Schnieglinger Straße 334 
90427 Nürnberg 
Germany 

Email: office@armbeag.uk

We act as the data controller within the meaning of the EU General Data Protection Regulation (GDPR).

We may collect and process the following categories of personal data:

a) Information you provide directly

• Name
• Billing and delivery address
• Email address
• Phone number
• Order details and customer communications

Payment information is processed exclusively by external payment service providers.
We do not process or store payment card details on our servers.

b) Automatically collected data

When you visit our website, certain technical information may be collected automatically, including

• IP address
• Browser and device information
• Date and time of access
• Pages visited and interaction data

c) Cookies and similar technologies

We use cookies and similar technologies in accordance with our Cookie Policy.
Non-essential cookies are only used after your explicit consent.

Personal data is processed on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR)
  to process and deliver orders and provide customer support
• Legal obligation (Art. 6(1)(c) GDPR)
  to comply with tax, accounting, and regulatory requirements
• Consent (Art. 6(1)(a) GDPR)
  for marketing communications and non-essential cookies
• Legitimate interests (Art. 6(1)(f) GDPR)
  to ensure website security, prevent fraud, and improve our services,
  provided that such interests do not override your fundamental rights and freedoms

We use personal data for the following purposes:

• Processing and fulfilling orders
• Communicating with customers regarding purchases and inquiries
• Managing payments via authorised payment service providers
• Improving website functionality and user experience
• Ensuring security and preventing fraud
• Complying with legal and regulatory obligations

Marketing communications are sent only where explicit consent has been given and can be withdrawn at any time.

We may share personal data with carefully selected third parties, solely where necessary, including:

• Payment service providers
• Logistics and delivery partners
• IT, hosting, and infrastructure service providers

Such data sharing is limited to what is required for the respective purpose and is conducted in accordance with applicable data protection laws.We do not sell personal data.

5a. Third-Party Service Providers (Data Processors)

We work with the following service providers, who may process personal data on our behalf:

• Payment processing: Stripe, Inc. (USA); PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)
• Shipping and logistics: DHL International GmbH (Germany); DPD Deutschland GmbH (Germany)
• Website hosting: Hosting Ukraine LLC (Ukraine). Server infrastructure is located in Germany. Data processing is governed by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
• Analytics: Google LLC (USA) — Google Analytics
• Marketing: Meta Platforms Ireland Ltd. (Ireland) — Facebook Pixel; TikTok Technology Ltd. (Ireland) — TikTok Pixel; Microsoft Corporation (USA) — Microsoft Clarity
• Email marketing: Klaviyo, Inc. (USA) / Klaviyo Ireland Limited (Ireland)
• Security: Google LLC (USA) — reCAPTCHA

Data processing by these providers is governed by data processing agreements (Auftragsverarbeitungsverträge) in accordance with Art. 28 GDPR.

Where personal data is processed outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

• Transfers to the United States: where the recipient is certified under the EU-US Data Privacy Framework (e.g. Google LLC, Microsoft Corporation, Stripe, Inc., Klaviyo, Inc.), the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). Where no such certification exists, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR are used.
• Transfers to Ukraine: our website hosting provider (Hosting Ukraine LLC) is established in Ukraine. The server infrastructure used for our website is physically located in Germany. Data processing by this provider is governed by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and a data processing agreement in accordance with Art. 28 GDPR.
• Transfers to other third countries: Standard Contractual Clauses (SCCs) or other approved safeguards under Art. 46 GDPR.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods include:

• Order and transaction data: up to 10 years after the end of the calendar year in which the transaction took place (§ 257 HGB, § 147 AO)
• Marketing and newsletter data: until consent is withdrawn
• Remarketing and advertising data: up to 180 days from last website interaction, as configured in our advertising platform settings (Meta, TikTok). Processing ceases immediately upon withdrawal of consent.
• Server log data: up to 30 days
• Cookie-related data: as specified in our Cookie Policy

After expiry of the applicable retention period, data is securely deleted or anonymised.

Under the GDPR, you have the right to:

• Access your personal data
• Request rectification of inaccurate data
• Request erasure of personal data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, please contact us at:
office@armbeag.uk

You also have the right to lodge a complaint with a competent data protection supervisory authority. The authority responsible for our business is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18, 91522 Ansbach, Germany

www.lda.bayern.de

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration.

We reserve the right to update this Privacy Policy from time to time.

The latest version will always be available on our website.