Privacy policy

This privacy policy informs you which personal data we process when you visit our online shop and when you place an order, and what rights you have.

1. Controller

Djoungol
Sole proprietorship, owner Amadou Ly
Ottostraße 5A
47198 Duisburg, Germany
Email: a.ly@lytrag.com
Phone: +49 176 24791472

No data protection officer has been appointed; there is currently no obligation to appoint one under section 38 of the German Federal Data Protection Act (BDSG), as fewer than 20 people in our company are permanently engaged in the automated processing of personal data. If you have questions about data protection, you can reach us using the contact details above.

2. Overview of processing activities

We process personal data in particular in the following cases:

  • when you visit our website (technical access data, cookies),
  • when you place an order (contact, address, payment and contract data),
  • when you use a customer account,
  • when you sign up for our newsletter,
  • when you contact us via the form or by email,
  • for web analytics and marketing, provided you have given your consent.

Depending on the case, the legal bases are Article 6(1)(a) GDPR (consent), (b) (performance of a contract), (c) (legal obligation) and (f) GDPR (legitimate interest), as well as section 25 of the German TDDDG for access to information on your device.

3. Hosting and shop system (Shopify)

Our online shop runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides hosting, shop software, basket and checkout and processes all data generated in the shop (access, order and customer data) as our processor under Article 28 GDPR.

Shopify belongs to Shopify Inc., based in Canada, and also uses data centres and service providers in the United States and Canada. For Canada there is an adequacy decision of the European Commission; for transfers to the United States, Shopify relies on the EU standard contractual clauses and, where the receiving entity is certified, on the EU-US Data Privacy Framework. Shopify also automatically screens incoming orders for indications of payment fraud; the decision whether to accept the order is made by us. The legal basis is Article 6(1)(b) GDPR (performance of the contract) and (f) GDPR (legitimate interest in the secure provision of the shop and in avoiding payment defaults). Further information: Shopify privacy policy.

4. Server log files

When you visit our website, Shopify automatically records information transmitted by your browser: IP address, date and time of access, page accessed, referrer URL, browser type and version and operating system. This data serves the provision, stability and security of the website (Article 6(1)(f) GDPR) and is not merged with other data sources.

5. Cookies and consent

Our website uses cookies and similar technologies. We use technically necessary cookies (for example for the basket, login and checkout) on the basis of section 25(2) TDDDG and Article 6(1)(f) GDPR. We only set all other cookies, in particular for analytics and marketing, if you have consented via our cookie banner (section 25(1) TDDDG, Article 6(1)(a) GDPR). You can withdraw or adjust your consent at any time with effect for the future by reopening the cookie settings via the corresponding notice in the shop. You can also delete or block cookies in your browser.

6. Order processing

When you order from us, we process the data required to conclude and perform the purchase contract: name, billing and delivery address, email address, phone number where applicable, items ordered, payment method and payment status. The legal basis is Article 6(1)(b) GDPR. We only pass data on to third parties where this is necessary to perform the contract (payment and shipping service providers as well as our tax adviser in the context of bookkeeping) or where we are legally obliged to do so (Article 6(1)(c) GDPR, for example tax retention obligations). Providing this data is necessary for concluding the contract; without it we cannot process your order. Picking and shipping take place from our own warehouses in Duisburg (Germany) and Brussels (Belgium); delivery data is used there exclusively for shipping. No automated decision-making within the meaning of Article 22 GDPR takes place at our company; regarding the credit check by Klarna, see point 7.

7. Payment service providers

For payment we use the following service providers, insofar as they are offered at checkout. The data required for payment (name, billing address, email address, order amount, and bank or card details where applicable) is transmitted directly to the respective provider; we do not store card details. The legal basis is Article 6(1)(b) GDPR.

  • Shopify Payments (credit and debit cards, Apple Pay, Google Pay, and Shop Pay where applicable), provided by Shopify International Limited, Ireland; the technical payment processing is carried out by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. With Apple Pay and Google Pay, Apple Distribution International Ltd. (Ireland) and Google Ireland Limited also process data under their own privacy terms. With Shop Pay, Shopify only stores your payment and address data for future orders with your consent.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
  • Klarna (for example pay on invoice, instalments): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out a credit check to decide which payment methods to offer (Article 6(1)(b) and (f) GDPR).

You can find details in the providers' privacy notices: Stripe, PayPal, Klarna.

8. Shipping service providers

To deliver your order we pass your name and delivery address to the commissioned shipping service provider, currently the commissioned parcel service (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, or GLS Germany GmbH & Co. OHG, GLS Germany-Straße 1-7, 36286 Neuenstein). The legal basis is Article 6(1)(b) GDPR. We only transmit your email address or phone number if this is necessary for the delivery or a parcel notification and you have consented at checkout (Article 6(1)(a) GDPR). For deliveries to other EU countries, delivery partners in those countries may be involved.

9. Customer account

You can create a customer account to view orders and save addresses. In doing so we process the data provided during registration as well as your order history (Article 6(1)(b) GDPR). You can have your customer account deleted at any time via the contact details under point 1; data subject to statutory retention obligations will be blocked until those obligations expire and then deleted.

10. Newsletter

With your consent we send you a newsletter by email with information about our products and offers (Article 6(1)(a) GDPR). Registration uses the double opt-in procedure: your address is only added to the mailing list after you click the confirmation link in our email. We log the registration and confirmation with the time and IP address in order to be able to prove consent (Article 6(1)(f) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of every email or by sending us a message; the lawfulness of the processing carried out until withdrawal remains unaffected. We use Shopify Email as a function of our shop system for sending; recipient data is then processed by Shopify (see point 3).

11. Contact form and email

If you contact us via the contact form or by email, we process your details (name, email address, message, order number where applicable) in order to handle your enquiry. The legal basis is Article 6(1)(b) GDPR if the enquiry relates to a contract, otherwise Article 6(1)(f) GDPR. We delete the data once your enquiry has been dealt with conclusively and no retention obligations prevent deletion.

12. Web analytics and marketing pixels

We only use the following services insofar as they are activated in our shop and you have consented via the cookie banner (Article 6(1)(a) GDPR, section 25(1) TDDDG). Without consent, no data is transmitted to these providers. The providers may transfer data to the United States and rely on the EU-US Data Privacy Framework and/or the EU standard contractual clauses.

  • Google Analytics and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): reach measurement, analysis of user behaviour and measurement of advertising performance. IP addresses are processed in truncated form. Google privacy policy
  • Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measurement and delivery of advertising on Facebook and Instagram as well as building audiences. For the collection and transmission of the data we are joint controllers with Meta (Article 26 GDPR). Meta privacy policy
  • TikTok pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland): measurement and optimisation of advertising on TikTok. TikTok privacy policy

We also use the statistics functions integrated into Shopify to evaluate visitor numbers and orders (see point 3). Which of the above services are active in an individual case depends on your consent in the cookie notice.

13. Social media presences

As soon as we operate profiles on social networks, we will provide information about our products there and be in contact with you. When you visit these profiles, the respective platform operator processes your data under its own privacy terms; we have only limited influence on this. For the statistics provided (for example page insights at Meta) we are joint controllers with the operator (Article 26 GDPR). The legal basis is Article 6(1)(f) GDPR.

14. Retention period

We only store personal data for as long as is necessary for the respective purpose. We retain contract and invoice data within the scope of commercial and tax retention obligations (in particular section 257 of the German Commercial Code HGB and section 147 of the German Fiscal Code AO, generally six to ten years). We delete data based on consent after withdrawal, unless another legal basis applies. Where third parties (for example Shopify, payment or shipping service providers) store data, their own periods apply.

15. Your rights

You have the following rights against us regarding the personal data concerning you:

  • right of access (Article 15 GDPR),
  • right to rectification (Article 16 GDPR),
  • right to erasure (Article 17 GDPR),
  • right to restriction of processing (Article 18 GDPR),
  • right to data portability (Article 20 GDPR),
  • right to withdraw consent given, with effect for the future (Article 7(3) GDPR).

Right to object (Article 21 GDPR): insofar as we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

A message to a.ly@lytrag.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de. You can also contact the supervisory authority of your place of residence.

16. Data security

Our website uses SSL/TLS encryption, recognisable by the padlock symbol and the https:// prefix in your browser's address bar. Data you transmit to us (for example orders, payment details, enquiries) is therefore encrypted during transmission. In addition, we and our service providers use technical and organisational measures to protect your data against loss, misuse and unauthorised access.

17. Changes to this privacy policy

We adapt this privacy policy when the legal situation, our offering or the services used change. The version published on this page applies in each case. Version of 22 August 2026.