Login

Language

Cart

Your cart is empty

Privacy policy

Last revision: 1 July 2026

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

M.IRIS · Owner: Michail Seryschew
Johanna-Etienne-Straße 77, 41468 Neuss, Germany
Phone: 015229206449 · Email: info@m-iris.de

We have not appointed a data protection officer, as there is no legal obligation to do so. For all questions regarding data protection, you can reach us at info@m-iris.de.

Introduction

M.IRIS operates this online shop and this website (the “Services”) to offer you personalised bracelets. Our shop is provided via the Shopify platform. In this privacy policy, we describe how we collect, use and share personal data when you visit or use our website, make a purchase or otherwise communicate with us.

The processing of your personal data takes place on the basis of the legal grounds set out in this policy (Art. 6 GDPR). Where consent is required (e.g. newsletter, non-essential cookies, and where applicable eye photos), we obtain it separately and expressly. In the event of a conflict between our General Terms and Conditions and this privacy policy, this privacy policy takes precedence with regard to the processing of your personal data.

What personal data we process

  • Contact data: name, postal address, billing and delivery address, phone number, email address.
  • Contract and transaction data: items viewed, placed in the shopping cart, purchased, returned or cancelled, order history, order status.
  • Payment data: payment method, transaction details and payment confirmation. Complete credit card/account details are processed by our payment service provider and not stored by us.
  • Account data (if you create a customer account): username, password, settings.
  • Personalisation data: uploaded eye photos or description of the eye colour, chosen letter charms and notes on the design.
  • Communication data: the content of your enquiries to us (email, chat, contact form).
  • Device and usage data: information about your device, browser, network, IP address, unique identifiers and your interaction with the Services.

Sources of the data

  • Directly from you (e.g. when ordering, creating an account, communicating, uploading eye photos).
  • Automatically via the Services (e.g. from your device, through cookies and similar technologies).
  • From our service providers (who process data on our behalf).

Purposes and legal bases of processing

  • Performance of the contract (order processing, manufacture, shipping, customer account, returns): Art. 6(1)(b) GDPR.
  • Customer service and communication: Art. 6(1)(b) or (f) GDPR (legitimate interest in good support).
  • Personalisation / eye photos: Art. 6(1)(b) GDPR and, where applicable, Art. 9(2)(a) GDPR (explicit consent).
  • Newsletter and direct marketing: Art. 6(1)(a) GDPR; for existing customers, where applicable, Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG).
  • Improvement of the Services, reach measurement, marketing via cookies: Art. 6(1)(a) GDPR in conjunction with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG); otherwise Art. 6(1)(f) GDPR.
  • Security and fraud prevention: Art. 6(1)(f) GDPR.
  • Compliance with legal obligations (e.g. retention under tax/commercial law): Art. 6(1)(c) GDPR; and for the assertion/defence of legal claims Art. 6(1)(f) GDPR.

Personalisation / processing of eye photos

To manufacture your personalised bracelet, we process the eye photos you upload or your description of the eye colour. The purpose is exclusively the colour design and production of your set (selection of matching beads).

Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR) and – insofar as the eye photos are to be classified as special categories of personal data within the meaning of Art. 9 GDPR – your explicit consent under Art. 9(2)(a) GDPR, which you give when uploading during the order process.

The images are stored via the service Cloudinary (USA – DPF-certified) and used exclusively to manufacture your set – never for other purposes, in particular not for advertising or training purposes. We delete the eye photos at the latest 90 days after delivery. We may retain the non-sensitive colour result (bead selection/preview) for longer for repairs and reorders. Our AI chat assistant has no access to the eye photos.

AI-supported customer service chat

On our website we offer an AI-supported chat assistant with which you can ask questions about our products and your order. The chat is clearly identified as AI at the start of the conversation.

Purpose and legal bases: We process your chat inputs in order to answer your enquiries and provide our customer service (Art. 6(1)(f) GDPR). Insofar as the chat, after prior verification (order number, email and surname or postcode), accesses information about a specific order, the processing takes place for the performance of the contract (Art. 6(1)(b) GDPR).

Data processed: chat inputs (your messages), technical connection data (e.g. IP address) and – only after successful verification – order-related data (e.g. order and shipping status). Your uploaded eye photos are not processed by the AI assistant.

Service providers / recipients used: For the AI responses we use the service Anthropic PBC (USA). The application is operated at Render Services, Inc. (USA/EU region). These service providers act as processors on our behalf.

Transfer to the USA: Anthropic, Cloudinary and Render are certified under the EU-US Data Privacy Framework (DPF); the transfer is based on this (Art. 45 GDPR) and, in the alternative, on standard contractual clauses (Art. 46 GDPR). By default, Anthropic stores API data only briefly (currently 7 days) and does not use it to train AI models.

Storage period: We store chat histories for up to 90 days and then delete them automatically. When stored, eye photo links are removed.

No automated decision-making: The chat does not make any automated individual decisions with legal effect concerning you (Art. 22 GDPR). For binding information and in sensitive cases, you can reach a human at any time at info@m-iris.de.

Cookies and similar technologies

On our website we use cookies and similar technologies. Technically necessary cookies (e.g. for the shopping cart, login, security) are required for operation; the legal basis is Section 25(2) TDDDG or Art. 6(1)(f) GDPR.

For non-essential cookies and technologies (e.g. statistics/reach measurement, marketing, personalised advertising), we obtain your consent in advance via our consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the cookie settings.

For statistics and marketing we use – only with your consent – the following services, which use cookies or similar technologies:

  • Google (Google Analytics and Google Ads; Google Ireland Ltd. / Google LLC, USA) – reach measurement and advertising.
  • Meta – Facebook & Instagram (Meta Pixel; Meta Platforms Ireland Ltd. / USA) – advertising and conversion measurement.
  • TikTok (TikTok Pixel; TikTok Technology Ltd. / TikTok Inc., USA) – advertising and conversion measurement.
  • Klaviyo (USA) – reach and open-rate measurement of our newsletters.

These services may also transfer personal data to the USA. The basis is the EU-US Data Privacy Framework, insofar as the respective provider is certified, otherwise standard contractual clauses (Art. 46 GDPR). You can withdraw your consent at any time via the cookie settings with effect for the future.

Newsletter and advertising

When you sign up for our newsletter (e.g. for the 10% discount code), we use your email address to send you marketing communications. Registration takes place using the double opt-in procedure: after signing up, you receive a confirmation email and are only added to the distribution list after clicking the confirmation link. The legal basis is your consent (Art. 6(1)(a) GDPR). For dispatch we use the service provider Klaviyo (Klaviyo, Inc., USA).

You can withdraw your consent at any time and object to receiving advertising – via the unsubscribe link in every email or by message to info@m-iris.de. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

Recipients / disclosure of personal data

We only disclose personal data insofar as this is necessary to fulfil the stated purposes:

  • Shopify – operation of the shop and the website.
  • Shopify Payments (operator: Shopify) – processes card (Visa, Mastercard, American Express, Maestro), wallet (Shop Pay, Apple Pay, Google Pay) and local payments (Bancontact, BLIK, EPS, iDEAL/Wero). In the case of payment by bank transfer (advance payment), no external payment service provider is involved.
  • Cloudinary (USA) – storage/processing of images (including eye photos, bead preview).
  • Anthropic (USA) – AI responses in the customer service chat.
  • Render (USA/EU) – hosting of our additional application.
  • Klaviyo (USA) – dispatch of newsletters/service emails.
  • Shipping service providers – DHL (Germany) and Hermes (abroad).
  • Authorities, courts, legal advisers – insofar as legally required; and, where applicable, in the case of a corporate transaction.

We conclude contracts with processors in accordance with Art. 28 GDPR. We do not sell your personal data.

Relationship with Shopify

The Services are hosted by Shopify; in the process, data may be transferred to Shopify and third parties in other countries. Further information at https://www.shopify.com/legal/privacy and https://privacy.shopify.com/en.

International transfer

We process personal data partly outside the EEA (including in the USA). For transfers to the USA, we rely on the EU-US Data Privacy Framework, under which Anthropic, Cloudinary and Render are certified (Art. 45 GDPR), and, in the alternative, on standard contractual clauses of the EU Commission (Art. 46 GDPR).

Storage period

  • Order/contract data: for the performance of the contract; tax/commercial-law documents 10 years (Section 147 AO, Section 257 HGB), commercial letters 6 years.
  • Customer account: until the account is deleted.
  • Eye photos: at the latest 90 days after delivery, then deletion (the non-sensitive colour result, where applicable, longer for repairs/reorders).
  • Chat histories: up to 90 days, then automatic deletion.
  • Newsletter data: until your withdrawal.
  • Server log files: for security purposes for 7 days, then deletion.

Children’s data

The Services are not directed at children. We do not knowingly collect personal data from persons under 16 years of age. As a parent/guardian, please contact us at info@m-iris.de for deletion.

Your rights

Within the framework of the statutory requirements, you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21(1)) as well as objection to direct marketing at any time (Art. 21(2)) and withdrawal of consent with effect for the future (Art. 7(3)). To exercise these, a message to info@m-iris.de is sufficient. For security reasons, we may need to verify your identity. You will not suffer any disadvantages.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de

Third-party websites and links

Our Services may contain links to third-party websites (e.g. Instagram, TikTok). The respective providers are solely responsible for their data processing.

Security of your data

We take appropriate technical and organisational measures (including TLS encryption, access controls). No internet transmission is completely secure; please do not transmit sensitive information via insecure channels.

Changes to this privacy policy

We may adapt this privacy policy. The current version is published on this website; the date of the “Last revision” is updated.

Contact

Phone: 015229206449 · Email: info@m-iris.de · Post: M.IRIS, Johanna-Etienne-Straße 77, 41468 Neuss, Germany.