Privacy Notice for the Online Shop

Last updated: September 2026

This English version is provided for convenience. The German version ("Datenschutz im Online-Shop") is legally binding; in case of any discrepancy, the German version prevails.

This privacy notice supplements the privacy policy of our website with the processing activities that take place when you shop in our online shop. For everything not covered here (for example audience measurement or contact forms on the website), the privacy policy of the website applies.

1. Controller

The controller responsible for processing your personal data in the online shop is:

• Sahara Urban GmbH (German limited liability company (GmbH))
• Sahara Urban GmbH, Teltower Damm 26, 14169 Berlin, Germany
• Represented by: Mostafa Quanjuri
• E-mail: info@saharaimbiss.de
• Phone: +49 151 29404197

2. Orders and contract processing

When you place an order with us, we process the data required to perform the purchase contract: name, delivery and billing address, e-mail address, phone number where provided, the items ordered, prices, the chosen shipping and payment method and an optional note on the order. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

Orders are processed without a customer account. You will receive a personal link by e-mail through which you can view your order and its status. This link contains a random access key; please do not share it.

For security reasons we store the IP address, the browser identifier (user agent) and the time of each order. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in preventing fraud and abuse and in being able to prove the conclusion of the contract.

We use your e-mail address for messages about your order (receipt and payment confirmation, shipping notification, queries). We only send you marketing e-mails if you have expressly consented (legal basis: Art. 6 (1) (a) GDPR) or if the statutory conditions for marketing to existing customers (Section 7 (3) of the German Unfair Competition Act, UWG) are met; you can object to further e-mails in every such message.

3. Shopping cart and strictly necessary cookies

To keep your shopping cart when you move between pages, we set a cookie containing a random cart identifier. The cookie contains no personal data; the contents of the cart are stored on our server. It is deleted no later than 30 days after the last activity. Storing and reading this cookie is strictly necessary to provide the service you have expressly requested – compiling and ordering goods (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). No consent is required for this. The legal basis for the associated processing is Art. 6 (1) (b) GDPR.

The shop only sets cookies for advertising or analytics purposes if it uses the services described in sections 10 to 12, and only with your consent given via the cookie notice. If the shop uses none of these services, no cookie notice is shown.

4. Payment processing via Stripe

Payments are processed by our payment service provider Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). Depending on the payment method chosen, you enter your payment details (card number, expiry date, security code, IBAN, Apple Pay or Google Pay confirmation, PayPal account) in a form provided by Stripe. This data is transmitted directly to Stripe and is not stored by us. In addition, we transmit to Stripe the invoice amount, the currency, an order reference, your e-mail address and – for fraud prevention – your name and billing address. Stripe also processes technical data about your device (for example IP address and browser identifier) to detect fraud.

The legal basis is Art. 6 (1) (b) GDPR (payment processing as part of contract performance) and, with regard to fraud prevention, Art. 6 (1) (f) GDPR. Stripe is partly an independent controller for payment processing, in particular in relation to banks and card schemes.

Stripe may transfer data to Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, California 94080, USA, and other companies of the Stripe group. For transfers to the USA, Stripe relies on the standard contractual clauses of the European Commission and on its certification under the EU-US Data Privacy Framework. Further information can be found in Stripe's privacy policy at https://stripe.com/privacy.

5. Shipping via DHL

To deliver your order, we transmit your name and delivery address to our carrier DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany ("DHL"). The legal basis is Art. 6 (1) (b) GDPR.

We do not pass on your e-mail address or phone number to DHL. You receive shipping notifications (dispatch, tracking number) exclusively from us.

We store the tracking number with your order so that both we and you can follow the delivery status.

6. E-mail delivery via Resend

To send order, payment and shipping notifications we use the service Resend of Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend"). For this purpose Resend receives your e-mail address and the content of the respective message and processes technical delivery information (time, delivery status). Resend acts as a processor on our behalf. For transfers to the USA, the standard contractual clauses of the European Commission have been agreed. The legal basis is Art. 6 (1) (b) GDPR.

7. Hosting and security via Cloudflare

Our shop runs on the infrastructure of Cloudflare: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany, as our contracting partner in the EU, and Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). When you access the shop, Cloudflare processes technically necessary connection data, in particular your IP address, the address accessed, the time, and browser and operating system identifiers. Cloudflare uses this data to deliver the shop, to fend off attacks and to ensure stability. Order and shopping cart data are stored in Cloudflare databases.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure, fast and reliable operation of the shop. Cloudflare acts as a processor on our behalf. For transfers to the USA, the standard contractual clauses of the European Commission have been agreed; Cloudflare, Inc. is also certified under the EU-US Data Privacy Framework. Further information can be found at https://www.cloudflare.com/privacypolicy/.

To protect against automated orders, Cloudflare Turnstile may be used at checkout. Turnstile uses technical characteristics of the browser to check whether a request comes from a human and temporarily stores data in the browser for this purpose. The legal basis is Art. 6 (1) (f) GDPR (protection against abuse); storage in the browser is necessary to provide the ordering process (Section 25 (2) no. 2 TDDDG).

8. Discount codes

If you redeem a discount code, we store the code with your order and count the redemptions in order to enforce the conditions of the code (for example a maximum number of redemptions). The legal basis is Art. 6 (1) (b) GDPR.

9. Address suggestions at checkout

If the shop uses address suggestions, the checkout completes the town for a German postcode you enter and suggests matching street names while you type; when you submit the order, it points out a postcode, town or street that do not match each other. You can still place the order with a differing address, and the form works without suggestions.

The data comes from the open database OpenPLZ (openplzapi.org), which is operated on servers of STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. The lookup runs through our server: only the postcode and the street fragment you typed are transmitted to the service – no names, no e-mail address, no house number and not your IP address. No cookies are set for this. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the correct delivery of your order and in avoiding misdirected shipments.

10. Cookies for advertising and analytics (consent)

If the shop uses services for advertising and analytics (Meta and Google, sections 11 and 12), a cookie notice at the bottom of the page asks you on your first visit whether you agree to the use of these services. The page remains usable in the meantime; "Decline" and "Accept" stand side by side as equals. Without your consent, no scripts of these providers are loaded, no advertising or analytics cookies are set and no data is transmitted to Meta or Google; the shop then works without any restriction.

We store your decision in the cookie "shop_consent" (lifetime twelve months); it only records whether you accepted or declined. You can change your decision at any time via the link "Cookie settings" in the footer of the shop; a withdrawal takes effect for the future (Art. 7 (3) GDPR).

Only with your consent do we additionally remember, in the cookie "shop_ref" (lifetime 30 days), which advertisement or campaign brought you to the shop: the campaign details from the address you opened (utm parameters) and the click identifiers of the providers (fbclid from Meta, gclid from Google). When you place an order, we store this origin together with the order and record whether you had consented, in order to know which advertisement led to which purchase; likewise only with your consent, we store the technical characteristics named in section 11 for matching at Meta.

The legal basis for storing and reading these cookies is Section 25 (1) TDDDG; for the associated processing it is your consent under Art. 6 (1) (a) GDPR.

11. Meta Pixel and Conversions API

If the shop uses the Meta Pixel and you have consented, we embed the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel records which pages you open in the shop, which products you view, add to the cart and buy (with item number, amount and currency), and sets the cookies "_fbp" and "_fbc". Meta may link this information to your Facebook or Instagram account in order to show you relevant advertisements and to report the performance of our advertisements to us; we ourselves only see aggregated reports.

In addition, we report a completed purchase from our server to Meta via the Conversions API: order reference, amount, currency and item numbers as well as – exclusively as SHA-256 hash values, never in plain text – e-mail address, phone number, first and last name, town, postcode and country from the billing address, plus the IP address, the browser identifier and the values of the cookies "_fbp" and "_fbc". This report is only sent if you had consented when placing the order; it is merged with the pixel's report via the order reference so that a purchase counts only once.

We likewise report from our own servers to Meta when you view a product, add it to the cart or start the checkout. What is transmitted is the type of event, the item numbers, the quantity, the amount and the currency – our server determines these details itself from our catalogue and your cart, not your browser – plus the address of the page you opened (without internal references; only the campaign details from the address are included), your IP address, the browser identifier (user agent), the values of the cookies "_fbp" and "_fbc" and, if you came to us via a Meta advertisement, the click identifier (fbclid) from the cookie "shop_ref" named in section 10. Details identifying you, such as your name, address, phone number or e-mail address, are not transmitted, not even as a hash value. We do not store your IP address permanently for these reports; we process it briefly in order to limit the number of requests. These reports too are only sent with your consent. Each of them carries the same random event reference as the corresponding report from the pixel in your browser, so that an event counts only once at Meta. This server-side route exists because reports from the browser frequently fail to arrive, blocked by ad blockers, browser settings or operating-system restrictions.

We and Meta are joint controllers for the collection and transmission of this data (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta may transfer data to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, and the standard contractual clauses of the European Commission apply in addition. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); you can withdraw it at any time via "Cookie settings" in the footer. Further information: https://www.facebook.com/privacy/policy/.

12. Google Ads and Google Analytics 4

If the shop uses Google Ads conversion tracking or Google Analytics 4 and you have consented, we embed the Google tag of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Ads conversion tracking records whether you came to the shop via a Google advertisement and whether a purchase resulted from it (order number, amount, currency); for this purpose the click identifier of the advertisement (gclid) is stored in a cookie. We only learn the number of purchases per advertisement, not persons.

Google Analytics 4 measures how the shop is used (pages opened, products viewed, cart, checkout, purchases, device and approximate region) and sets cookies with a random identifier for this purpose ("_ga", "ga…", lifetime up to two years). Google Analytics 4 uses your IP address only to determine the approximate region and does not store it (the IP address is truncated or discarded by Google). The reports contain no persons, only totals. We have set the retention of user data in Google Analytics to 14 months; after that it is deleted.

Google may transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Google LLC is certified under the EU-US Data Privacy Framework, and the standard contractual clauses of the European Commission apply in addition. For Google Analytics, Google acts as a processor on our behalf. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); you can withdraw it at any time via "Cookie settings" in the footer. Further information: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.

13. Retention period

We retain order data including invoice and payment data for as long as required by commercial and tax law retention obligations: accounting records and invoices for eight years, commercial and business letters for six years (Section 147 of the German Fiscal Code, AO; Section 257 of the German Commercial Code, HGB). The period begins at the end of the calendar year in which the order was placed. After the periods have expired, we delete the data unless warranty or other claims are still open.

Shopping cart data without an order is deleted no later than 30 days after the last activity. The IP address and browser identifier stored with an order are deleted no later than twelve months after the order. E-mail delivery logs are deleted no later than twelve months after sending. Connection data at Cloudflare is deleted or anonymised after a short time.

Your decision on the cookie notice remains in the cookie "shop_consent" for twelve months, the origin of a visit in the cookie "shop_ref" for 30 days. The origin stored with an order (source, medium, campaign) remains part of the order data; the click identifiers it contains (fbclid, gclid) and the technical characteristics stored for the Conversions API are deleted no later than twelve months after the order. The retention period at Meta and Google is governed by their privacy notices; for Google Analytics 4 it is set to 14 months.

14. Recipients

Your data is only received by the service providers named in this notice (Stripe, DHL, Resend, Cloudflare and – if the shop uses address suggestions – the operator of the OpenPLZ database, which receives only the postcode and street fragment, and – if the shop uses these services and you have consented – Meta and Google, sections 11 and 12) and, where required by law, by authorities such as the tax office. Within our company, only the persons responsible for processing orders have access.

15. Your rights

You have the following rights with regard to your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR), unless retention obligations prevent this,
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR),
• right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, an e-mail to info@saharaimbiss.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority of your habitual residence or the authority responsible for us.

16. No automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you. Stripe's fraud check may result in an individual payment being declined; in this case you can choose another payment method or contact us.

17. Obligation to provide data

Providing the data required for the order (name, address, e-mail address, payment details) is necessary for concluding the contract; without it we cannot process your order. All other information (phone number, note) is voluntary.