Privacy Policy

Last updated: September 7, 2026

Store and contact details

Store name: Mytuku

Business address: Joseph-Haydn-Straße 9, Rosenheim 83024, Germany

1. Controller and scope

The operator of Mytuku is the controller for personal data processed through this store. Privacy questions and rights requests may be sent to hello@mytuku.com, by telephone at +49 172 2908431, or by post to Joseph-Haydn-Straße 9, Rosenheim 83024, Germany.

2. Personal data collected

Depending on how you use the store, we process identity and contact details, billing and delivery information, order and return history, payment tokens and transaction status, account information, customer communications, device and log information, cookie identifiers, marketing preferences, fraud signals and records needed for product-safety obligations.

3. Sources and purposes

Data is obtained from you, your device or browser, Shopify, payment providers, DHL, fraud-prevention tools and service providers. We use it to process orders and payments, deliver goods, manage returns and refunds, provide support, maintain security, prevent fraud, meet tax and product-safety duties, manage legal claims and send marketing where lawfully permitted.

4. Legal bases

Processing is based, as applicable, on contract performance and pre-contract steps, compliance with legal obligations, legitimate interests balanced against individual rights, consent, or protection of vital interests. Consent may be withdrawn for future processing without affecting earlier lawful processing.

5. Cookies and marketing technologies

Strictly necessary technologies support the cart, checkout, security, fraud prevention and consent storage. Non-essential analytics, personalisation and advertising technologies are activated only after consent where required. Cookie choices can be changed at any time through the cookie-preference control displayed on the website.

6. Recipients and processors

Shopify provides the e-commerce platform. Shopify Payments and supported card networks process payments. DHL supports delivery and tracking. Hosting, security, analytics, advertising and customer-service providers receive only information reasonably necessary for their services and are identified through the store's current cookie and service disclosures.

7. International transfers

Where personal data is transferred outside the European Economic Area, we use an adequacy decision or another lawful safeguard, including approved standard contractual clauses and supplementary measures where required.

8. Retention

Order, invoice and tax records are retained for the statutory period, generally up to ten years. Customer-support and ordinary contractual-claim records are generally retained for three years after the end of the relevant year. Technical security logs are generally retained for up to twelve months. Marketing data is retained until consent is withdrawn or the data is no longer required; limited suppression records may be retained for up to three years to honour opt-out choices.

9. Security

We use proportionate technical and organisational measures, role-based access, secure payment providers and service-provider controls. No transmission or storage method can be guaranteed completely secure.

10. Individual rights

Subject to legal conditions and exceptions, individuals may request access, correction, erasure, restriction, portability and objection, and may withdraw consent. Requests may be sent to hello@mytuku.com. We respond within the GDPR deadline and explain any lawful extension or refusal.

11. Automated decisions and children

Fraud and payment tools may generate risk signals, but we do not use solely automated decision-making that produces legal or similarly significant effects without an available human review where required. The store is intended for customers aged 18 or older.

12. Complaints

Privacy complaints may be sent to hello@mytuku.com. You may also contact the Bavarian State Office for Data Protection Supervision or use an available judicial remedy.

13. Changes

Material changes are dated and published on this page. A new purpose requiring consent is not applied retroactively without the required notice and legal basis.