Last updated: October 2026. This is a translation of our German privacy policy; in case of differences the German version applies.
1. Controller
Moda Mix, owner Malek Mohammed Nasif, Hauptstraße 28, 42651 Solingen, Germany. E-mail: [email protected], phone: +49 1521 9658830. More details in the legal notice.
2. Visiting the website
When you open our pages, our hosting provider and our security and delivery service Cloudflare process technically necessary data (e.g. IP address, date and time, page requested, browser). This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). The data is only kept as long as needed for security and error analysis.
3. Orders and customer account
To process your order we use your name, delivery and billing address, e-mail address, phone number, ordered items and payment status (Art. 6(1)(b) GDPR). A customer account is optional; it stores your addresses and orders. If you sign in with Google, we receive your name and e-mail address from Google. While you type your address we suggest addresses via Google Maps (Places) and OpenPLZ; these requests go through our server, so your IP address is not passed to these services.
Size finder (“Find your size”)
When you use the size finder, we process the details you enter (height, weight, optionally bust, usual size, shoe size and preferred fit; for your children name, age and height; for your husband the same measurements) to suggest a size. Without logging in, the details stay in your browser only and are sent to our server for the calculation without being stored there. We keep them in your customer account only if you tick the box “Keep my measurements … in my account” (Art. 6(1)(a) GDPR); as proof we store the time, the wording of the consent and the IP address. You can change or delete them at any time on the My sizes page; they are also deleted together with your account. We do not use them for advertising and do not pass them on to third parties.
4. Payment
Payments are processed by Stripe Payments Europe Ltd. (Ireland). Depending on the method chosen, Klarna, Amazon Pay, Scalapay, Satispay, Apple Pay or Google Pay are also involved. They receive the data needed for the payment and fraud prevention (Art. 6(1)(b) and (f) GDPR). We never see your full card details.
If you choose PayPal, the payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). PayPal receives the data needed for the payment (Art. 6(1)(b) GDPR); for “Pay Later” PayPal’s own terms apply as well.
5. Shipping
For delivery we pass your name, delivery address and – for delivery notifications – e-mail address or phone number to DHL or GLS. For deliveries outside the EU, customs documents also contain details of the goods (Art. 6(1)(b) and (c) GDPR).
6. Communication
We send you e-mails about your order, shipping and returns. Via WhatsApp (Meta) we inform you about your order status and answer your questions if you message us there, based on contract performance and our legitimate interest in fast communication (Art. 6(1)(b) and (f) GDPR); you can stop WhatsApp notifications at any time. Our team is notified internally about new orders via Telegram. You only receive our newsletter with your consent (Art. 6(1)(a) GDPR) and can unsubscribe at any time.
Newsletter, cart reminder and WhatsApp offers
We send news and offers by e-mail, and a reminder about an unfinished cart (up to three e-mails within three days, the last one with a personal discount code), only with your consent (Art. 6(1)(a) GDPR, § 7(2) UWG). Sign-up uses double opt-in: you receive no marketing until you have clicked the link in our confirmation e-mail. As proof we store the time, the source (e.g. checkout or newsletter box), the IP address and the wording of the consent. Offers on WhatsApp reach you only if you switch them on yourself with your phone number. You can withdraw any consent at any time with effect for the future – via the link in every e-mail or on the message preferences page. After a withdrawal we keep your address only as proof of the consent and its withdrawal.
7. Cookies, analytics and advertising
We always use technically necessary cookies (e.g. cart, login, language) (§ 25(2) TDDDG). Analytics and marketing services – Google Analytics, Google Ads, Meta Pixel, TikTok Pixel and Snapchat Pixel, partly also via their server-side interfaces – are only used if you consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time in the cookie settings. Without any cookie, we analyse within the current session which page or campaign led to an order (e.g. a search engine or an Instagram link) to improve our marketing (Art. 6(1)(f) GDPR). Details of all cookies: Cookie policy.
Product reviews
After delivery you can review the pieces you bought (stars, text, up to three photos, fit). Reviewing is only possible from your order page or your personal order link. With your consent when sending, we publish the review with the name shown (e.g. “Fatima M.”) on the product page (Art. 6(1)(a) GDPR). We remove location and camera data from photos. You can change your review with the same link; to delete it, write to us. We do not publish abusive content, links or contact details.
Google Customer Reviews
If you accepted “Marketing” in the cookie banner, Google shows a window of the “Google Customer Reviews” programme (Google Ireland Ltd.) on the confirmation page after an order. Only if you agree there, Google receives the order number, e-mail address, delivery country and estimated delivery date and sends you a survey about your order (Art. 6(1)(a) GDPR). Your rating may appear at Google as a seller rating. Google’s privacy policy applies.
8. Transfers outside the EU
Some providers (e.g. Google, Meta, Stripe, TikTok, Snap, Cloudflare, Telegram) also process data outside the EU, for example in the USA. Such transfers are based on an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework) or on EU standard contractual clauses.
9. Storage period
We keep order and invoice data for up to 10 years due to commercial and tax law obligations (§ 147 AO, § 257 HGB). Account data is kept until you have the account deleted. Data based on consent is deleted after withdrawal; cookie durations are listed in the cookie policy.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw consent at any time with effect for the future. Just write to [email protected]. You can also lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.