Privacy policy

Last updated: August 2026

The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of the legal provisions (GDPR, TMG, TTDSG). In this privacy policy, we inform you about the most important aspects of data processing in connection with our website and online shop.

1. Data Controller

BruScale UG (haftungsbeschraenkt) Schorlemerstr. 88, 40547 Duesseldorf, Germany Managing Director: Dirk Bruese Commercial Register: Amtsgericht Duesseldorf, HRB 112818 Email: privacy@auzea.shop

Data Protection Officer: Not currently appointed, as this is not legally required given the size and nature of our business operations (§ 38 BDSG).

2. Data We Collect

  • Name and address when placing orders
  • Email address for order confirmations and communication
  • Payment data (processed via encrypted payment service providers)
  • IP address and technical connection data when visiting the site
  • Order history and purchasing behaviour for contract fulfilment
  • Device information, browser type and operating system for technical purposes

3. Purpose of Data Processing

  • Fulfilment and processing of purchase contracts (Art. 6(1)(b) GDPR)
  • Sending order confirmations and delivery updates
  • Customer service and communication
  • Legal retention obligations (Art. 6(1)(c) GDPR)
  • Legitimate interests of the operator (Art. 6(1)(f) GDPR)
  • Newsletter and marketing communications (only with explicit consent, Art. 6(1)(a) GDPR)

4. Disclosure of Data to Third Parties

  • Payment service providers (Shopify Payments, PayPal, Stripe, AfterPay) for payment processing
  • Shipping and tracking service providers (AfterShip) for delivery updates and order tracking
  • Dropshipping suppliers (e.g. CJdropshipping, SaleHoo) for order fulfilment
  • Email marketing (Klaviyo, Inc., USA) for order confirmations, newsletters and marketing communications (only with consent)
  • Customer service platform (Gorgias) for handling support requests and communication
  • Reviews and on-site upsell tools (Vitals) for product reviews, upsells and related on-site features
  • Automation and workflow tools (Make.com) for connecting and automating the above services
  • IT service providers (Shopify Inc.) as the primary data processor for our shop

Data will not be passed on to third parties for advertising purposes without your express consent.

5. International Data Transfers

As we deliver to Australia and New Zealand, and use service providers based outside the EU/EEA (including Shopify Inc. in Canada and Klaviyo, Inc. in the USA), data may be transferred to third countries. These transfers take place on the basis of EU standard contractual clauses (SCCs) or other appropriate safeguards pursuant to Art. 46 GDPR. For Australian customers, we comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). For New Zealand customers, we comply with the Privacy Act 2020.

6. Cookies and Tracking

Our shop uses cookies in accordance with the German Telecommunications-Telemedia Data Protection Act (TTDSG) and the GDPR, for:

  • Technically necessary cookies (session, shopping cart) — no consent required
  • Analytics cookies (only with your consent via the cookie banner)
  • Marketing cookies, including for retargeting on advertising platforms (only with your consent)

You can withdraw or adjust your consent at any time via the cookie banner, or deactivate cookies in your browser settings.

7. Shopify as Data Processor

Our shop is operated on the Shopify platform. Shopify Inc., 151 O'Brien Street, Ottawa, ON K1P 5H3, Canada, processes data as a data processor in accordance with Art. 28 GDPR. For details see: https://www.shopify.com/legal/privacy

8. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

9. Your Rights

  • Right of access (Art. 15 GDPR / Australian Privacy Principle 12 / NZ Privacy Act s. 22)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, contact: privacy@auzea.shop. We will respond within 30 days.

10. Right to Lodge a Complaint

Germany: Landesbeauftragte fuer Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Duesseldorf. Australia: Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au New Zealand: Office of the Privacy Commissioner: www.privacy.org.nz

11. Children's Privacy

Our shop is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@auzea.shop so we can delete it.

12. Data Retention

We store your data only for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. 10 years for tax-relevant documents under German law).

13. Security

We implement appropriate technical and organisational security measures to protect your personal data. Our website uses SSL/TLS encryption for data transmission.