Privacy policy

Last updated: 22 August 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

CoralPrime
Owner: Seyedmassoud Ghafuri
Pestalozzistr. 3a
45479 Mülheim an der Ruhr
Germany

Phone: 0176 36386227
Email: info@coralprime.de

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our online shop, process orders, communicate with you, process payments, ship your order, or comply with legal obligations.

Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, name, address, email address, telephone number, payment information, order data, IP address, and technical usage data.

Processing is carried out in particular on the basis of:

Art. 6(1)(b) GDPR for taking steps prior to entering into a contract and for the performance of a contract,
Art. 6(1)(c) GDPR for compliance with legal obligations,
Art. 6(1)(f) GDPR on the basis of our legitimate interests,
Art. 6(1)(a) GDPR where we obtain your consent.

3. Hosting and Shop System – Shopify

Our online shop is operated using Shopify.

Provider:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

In connection with the operation of our shop, Shopify processes personal data, including in particular IP addresses, device and browser information, usage data, contact details, order information, and payment information.

The processing is carried out in particular for the technical provision of the shop, processing of orders, fraud prevention, improvement of the platform, and provision of additional Shopify functions.

Where Shopify processes personal data on our behalf, this is carried out on the basis of a data processing agreement. Shopify may use additional service providers to provide its services and may also process data outside the European Economic Area. According to Shopify, appropriate safeguards are used in such cases.

Further information about Shopify’s processing of personal data can be found in Shopify’s Consumer Privacy Policy.

4. Data We Process

Depending on how you use our shop, the following data may in particular be processed:

Contact data:
Name, billing address, shipping address, telephone number, and email address.

Order and contract data:
Products ordered, prices, payment method, shipping method, time of order, delivery date, returns, and cancellations.

Payment data:
Information relating to the selected payment method and payment processing.

Technical data:
IP address, browser type, operating system, device data, time of access, and technical usage information.

Communication data:
Content of messages that you send to us, for example by email or via a contact form.

5. Orders and Contract Processing

When you place an order in our online shop, we process the data you provide in order to process and fulfil your order.

This includes in particular:

Name
Billing and shipping address
Email address
Telephone number, where provided or required for delivery
Products ordered
Payment information
Requested shipping or pickup method
Where applicable, the requested delivery date

The legal basis is Art. 6(1)(b) GDPR.

In addition, we may store certain data due to retention obligations under tax and commercial law. The legal basis for this is Art. 6(1)(c) GDPR.

6. Payment Processing

We use external payment service providers to process payments. Depending on the payment method you select, the data required for payment processing will be transmitted to the relevant service provider.

Shopify Payments

When using Shopify Payments, payment processing is carried out via the payment services provided by Shopify.

This may include the processing of your name, billing address, payment information, transaction data, IP address, and other data required for payment verification or fraud prevention.

The legal basis is Art. 6(1)(b) GDPR.

PayPal

If you pay using PayPal, the personal data required to process the payment will be transmitted to PayPal.

Provider:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal processes data in particular for payment processing, prevention of fraud and misuse, and compliance with legal obligations.

The legal basis is Art. 6(1)(b) GDPR.

PayPal is independently responsible for any further processing of data carried out by PayPal.

7. Shipping and Delivery

In order to carry out shipping, we provide the necessary personal data to the transport company used for the respective shipment.

This may include in particular:

Name
Shipping address
Telephone number
Email address
Shipping and order information

The data is transmitted only to the extent necessary for delivery of the order.

The legal basis is Art. 6(1)(b) GDPR.

Note: Once GO! Express has been technically connected to the shop, this section should be supplemented by expressly naming GO! Express as a shipping service provider.

8. Local Pickup

If you select local pickup, we process your order data in order to prepare and make your order available at the specified pickup location.

The legal basis is Art. 6(1)(b) GDPR.

9. Contacting Us

If you contact us by email, contact form, or telephone, we process the information you provide in order to handle your inquiry.

This may include in particular your name, email address, telephone number, and the content of your message.

If your inquiry relates to an existing or future contract, processing is carried out on the basis of Art. 6(1)(b) GDPR. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in responding to customer inquiries.

10. Email Communication / Google Workspace

We use Google Workspace for our business email communications.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

If you contact us by email, your contact details and the content of the communication may be processed through Google systems.

Depending on the content of your inquiry, the legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR.

11. Cookies and Similar Technologies

Our online shop uses cookies and comparable technologies.

Cookies may in particular be required in order to:

provide the shopping cart,
store login and language settings,
ensure the security of the shop,
provide payment and checkout functions,
technically enable use of the shop.

In addition, where activated and legally permitted, analytics, marketing, or personalization cookies may be used.

Shopify distinguishes, among other things, between strictly necessary, performance, advertising, and social media/content cookies.

Where cookies or comparable technologies are not strictly necessary to provide the service requested by you, they will only be used with your consent.

The legal basis for the processing of personal data in these cases is Art. 6(1)(a) GDPR.

You may withdraw or change your consent at any time via the cookie or privacy settings of our shop.

12. Fraud Prevention and Security

To ensure secure order and payment processing, Shopify, payment service providers, and we may process data in order to detect and prevent fraudulent or abusive activities.

This may include in particular IP address, device information, payment data, and transaction information.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the protection of our company, our customers, and our payment systems against fraud and misuse.

13. Retention Period

We store personal data only for as long as necessary for the respective purpose.

Data relating to orders and invoices may be stored for several years due to statutory retention obligations under commercial and tax law.

Inquiries and other communication data will be deleted when they are no longer required for the respective purpose and there are no statutory retention obligations preventing deletion.

14. Disclosure of Personal Data

We disclose personal data only where:

this is necessary for the performance of a contract,
we are legally required to do so,
a legitimate interest exists,
you have expressly given your consent.

Recipients may in particular include:

Shopify
Payment service providers
Shipping service providers
IT and hosting service providers
Email service providers
Tax advisers and public authorities, where legally required

15. Data Transfers to Third Countries

When using Shopify, Google, payment service providers, or their subcontractors, it cannot be completely excluded that personal data may be processed outside the European Union or the European Economic Area.

Where no adequacy decision by the European Commission exists for the country concerned, transfers are generally carried out only on the basis of appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses or other legally recognized protection mechanisms.

Shopify states that safeguards for international data transfers are used for European merchants.

16. Your Rights

Subject to the applicable legal requirements, you have in particular the following rights:

Right of Access

You may request information about the personal data we process about you.

Right to Rectification

You may request the correction of inaccurate data.

Right to Erasure

Under certain conditions, you may request the deletion of your personal data.

Right to Restriction of Processing

Under certain conditions, you may request restriction of the processing of your personal data.

Right to Data Portability

Under certain conditions, you may request to receive personal data in a structured, commonly used, and machine-readable format.

Right to Object

Where we process personal data on the basis of a legitimate interest, you may object to such processing subject to the applicable legal requirements.

Withdrawal of Consent

You may withdraw any consent you have given at any time with effect for the future.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

In particular, you may contact the data protection supervisory authority responsible for North Rhine-Westphalia.

18. Security

We use appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, or unauthorized alteration.

Payment processing is carried out through specialized payment service providers. Shopify is, among other things, certified to PCI DSS Level 1.

19. Shopify Privacy Rights

Shopify may additionally process certain personal data under its own responsibility, in particular in connection with extended Shopify services.

Information about Shopify’s processing of personal data and the corresponding privacy rights can be found in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

20. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if our online shop, the service providers we use, or legal requirements change.

The current version is available on this website.

21. Data Protection Contact

If you have questions about the processing of your personal data or wish to exercise your data protection rights, please contact:

CoralPrime
Owner: Seyedmassoud Ghafuri
Pestalozzistr. 3a
45479 Mülheim an der Ruhr
Germany

Phone: 0176 36386227
Email: info@coralprime.de