This is an English translation of our German privacy policy.

Last updated: 27 September 2026

1. Controller and contact

The controller (Verantwortlicher) for the processing described below is Sensual Matcha Dawson, Yolanda & Mochine, Philipp GbR, An der Urania 5, 10787 Berlin, Germany. Please send data protection enquiries and requests to exercise your rights to ritual@sensualmatcha.com or by post to this address.

2. Our shop and your orders

Our online shop is provided by Shopify. When you visit, technically necessary connection data, in particular your IP address, time of access, pages accessed, and device and browser data, are processed to serve the pages, ensure security and resolve errors. Providing a functional and secure shop is in our legitimate interest (Art. 6(1)(f) of the General Data Protection Regulation (GDPR; Datenschutz-Grundverordnung, DSGVO)). Where technically necessary information is stored on or read from your terminal equipment, this serves the shop functionality you have requested (§ 25(2) TDDDG).

When you place an order or use a customer account, we process your contact, billing and delivery data, the items ordered, order and payment status, and your communications relating to the order. This is necessary for the performance of the purchase contract and steps prior to entering into a contract (Art. 6(1)(b) GDPR). We retain legally required invoices and business records in accordance with the applicable obligations under commercial and tax law (Art. 6(1)(c) GDPR). You must provide the information marked as required for the order; otherwise we cannot complete the order.

Payment is processed through the payment methods offered at checkout and their respective payment service providers. Under our current shop configuration, these include Shopify Payments/Shop Pay, PayPal and Klarna and, depending on the device, Apple Pay and Google Pay. The respective providers receive the data necessary to process the payment. We receive, in particular, the payment method, status and transaction details; the specific entry and processing of payment data depend on the payment method selected. We transmit the recipient and order data necessary for delivery and shipment processing to DHL and the service providers entrusted with storage and shipping. For invoicing and inventory management processes, we use Billbee, Lexware and VDS/Pixi insofar as the respective order requires this.

Shopify also processes data as a controller in its own right, particularly for its services and security. Shopify Network Intelligence is enabled in our shop. This allows Shopify to process data about interactions with our shop, other shops and Shopify for enhanced features. According to its description, Shopify acts in part as a controller in its own right for this processing. Further information and your rights in relation to Shopify can be found in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal. You can manage consent and objections for the relevant Shopify features through the privacy settings offered in the shop or the Shopify portal.

3. Cookies, local storage and consent

The shop uses technically necessary cookies or comparable storage, for example for the basket, checkout, security and your privacy choices. We ask you to make separate choices for analytics and marketing. Access to your terminal equipment that is not necessary requires consent under § 25(1) TDDDG; the subsequent analysis of personal data is based on Art. 6(1)(a) GDPR. You can change your choices at any time via “Cookies” in the footer or withdraw consent with effect for the future. This does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Audience measurement with Google Analytics 4

If you consent to analytics, we use Google Analytics 4 to understand which pages and shop features are used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Pseudonymous online identifiers, device and browser data, page views and events may be transmitted to Google. A pseudonymous identifier is not anonymous. When measuring use of the newsletter form, we do not transmit any email address, text entered, hashed email address or free-text error message.

For form measurement, we record only with analytics consent whether the newsletter popup was visible and opened, which of the fixed quiz options was selected, whether an email field was focused or input was started, whether a submission was attempted, and whether the registration Worker accepted a double opt-in request or returned a fixed error category. An accepted request does not mean a confirmed newsletter subscription. The existing Google/Shopify integration for other page and commerce events is separate from this.

In our GA4 settings, Google Signals is disabled and no Google Ads accounts are linked. Retention of individual event data is set to two months and retention of user data to 14 months; the user data retention period restarts upon new activity. Standard aggregated reports are exempt from these periods. Consent is given and withdrawn through the shop’s privacy choices. Google explains data retention in Analytics.

5. Newsletter with double opt-in

If you request our newsletter, we process your email address, the source of the form and, if you selected an option in the popup, one of the fixed Matcha quiz categories. The form sends the information to Brevo via a Cloudflare Worker. Brevo first sends a confirmation email. Registration is completed and the contact added to the relevant mailing list only once the confirmation link has been clicked. We document registration and confirmation as evidence of your consent. The legal basis for the newsletter and the selection of appropriate welcome emails is your consent (Art. 6(1)(a) GDPR); the documentation serves the requirement to demonstrate consent under Art. 7(1) GDPR.

After confirming your subscription, you receive newsletters and appropriate welcome emails. Brevo measures opens and link clicks in newsletter emails and can attribute these to individual contacts. We use this information to understand the reach and use of our messages. Informed consent is required for this individual analysis (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time using the unsubscribe link in each email or by contacting us. After you unsubscribe, we erase or block mailing data insofar as we do not need it to document a withdrawal of consent or to defend against claims. Merely submitting the form or requesting double opt-in (DOI) does not count as a confirmed subscription.

6. Order-related emails and reviews

For order, invoice and other necessary service messages, we use the email address provided when ordering. Depending on the relevant process, messages are sent via Shopify, Billbee and Mailgun. Order-related post-purchase messages are also triggered by a Cloudflare Worker of our own using order data and sent via Mailgun. These processes handle, in particular, the email address, order time, item and quantity details, and shipping or fulfilment status. Messages required under the contract are based on Art. 6(1)(b) GDPR; advertising to existing customers is additionally subject to the conditions of § 7(3) UWG and a right to object at any time. You can unsubscribe from such messages via the respective unsubscribe link without this affecting necessary order or invoice messages.

After a purchase, a request for a product review and a reminder may be sent via Mailgun. A Cloudflare Worker controls sending on the basis of the order. For a submitted review, we process the star rating, text, display name, reference to the order and any voluntarily uploaded photos, as well as the IP address at the time of submission. Reviews are stored in Shopify metaobjects and photos in Shopify Files; approved reviews appear on the product page. We base the processing of submitted reviews and verification of their authenticity on our legitimate interest in authentic product information and protection against abuse (Art. 6(1)(f) GDPR). You can object to further review requests via the unsubscribe link.

Recipe ratings: If you award stars on a recipe page, we store only the star rating and the time. To prevent duplicate votes, we store an irreversible checksum of your IP address for 30 days, rather than the IP address itself. The service provider is Cloudflare. The legal basis is Art. 6(1)(f) GDPR.

7. Contact, withdrawal form and email service providers

If you write to us, we process your message and contact details to deal with your enquiry. We use Zoho Mail for mailboxes and correspondence. Depending on the content, we base processing on steps prior to entering into a contract or contractual measures (Art. 6(1)(b) GDPR), or on our legitimate interest in responding to other enquiries (Art. 6(1)(f) GDPR). Statutory documentation obligations remain unaffected.

The withdrawal form (Widerrufsformular) in the shop transmits your information via a Cloudflare Worker. The Worker uses Mailgun for the acknowledgement of receipt and internal notification. We process the information to identify what your declaration relates to and to fulfil statutory consumer rights (Art. 6(1)(b) and (c) GDPR).

8. Fonts, external content and links

To display fonts, your browser loads Adobe Fonts via use.typekit.net. This technically establishes a connection to Adobe servers; connection and device data, such as your IP address, may be generated. The purpose is to display the shop consistently. Adobe explains how web fonts are delivered.

In some Journal articles, we show a locally stored preview of an Instagram Reel. Only when you click it does your browser load the embedded content from Instagram/Meta Platforms; connection and usage data are then transmitted to Meta. Clicking constitutes your decision to load the external content. Alternatively, you can read the article without the Reel. Information on further processing can be found in Meta’s privacy information.

Our pages may contain links to external services. If you open such a link, the privacy information of the respective operator applies.

9. Recipients, transfers to third countries and retention

Recipients are the service providers needed for the purposes described: in particular, Shopify for the shop and checkout, the selected payment services, DHL and fulfilment partners, Billbee/Lexware, Cloudflare, Brevo, Mailgun, Zoho, Google, Adobe and, if you choose to load a Reel, Meta. Some providers or their subcontractors may process data outside the European Economic Area. You can obtain the applicable information on destination countries and safeguards, as well as a copy of the relevant safeguards, on request by contacting us.

We store personal data only for as long as necessary for the respective purpose and statutory obligations. Commercial and tax law retention obligations apply to orders and invoices; processing and evidence retention periods apply to support and withdrawal; for newsletters, data are retained until consent is withdrawn, plus necessary evidence; for reviews, until erasure or for as long as legal grounds prevent erasure. Technical security data are retained for limited periods according to the respective operational requirements.

10. Your rights and complaints

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, subject to the applicable conditions. You can object to processing for direct marketing purposes at any time. You can withdraw consent at any time with effect for the future. To exercise your rights, simply send a message to the address given in section 1; if we have reasonable doubts, we may request proof of identity. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement. For our registered office in Berlin, the Berlin Commissioner for Data Protection and Freedom of Information is a relevant authority.

Our service is not specifically directed at children. We do not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Art. 22 GDPR. If we change our data processing, we will update this policy and its version date.