Privacy policy

Privacy Policy

Last updated: August 4, 2026

Damascus Box operates this online store and all related content, features, tools, products and services (the "Services"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies whenever you visit our store, place an order, sign up for our newsletter, or contact us.

We are based in Germany, so we handle your personal data in line with the EU General Data Protection Regulation (GDPR) and German data protection law. If anything in our Terms of Service conflicts with this Privacy Policy, this Privacy Policy applies to the handling of your personal data.

1. Who We Are and How to Reach Us

Damascus Box is the controller of the personal data described in this policy. We are a registered small business (Kleingewerbe) in Germany, operating under the small business rule of § 19 UStG, and we ship our handcrafted Damascene mosaic pieces from Berlin.

The controller responsible for your personal data is:

Damascus Box
Yazan Krayem
Gartenstr. 58,
13355 Berlin,
Germany

You can reach us about any privacy matter by email at info@damascusbox.com. We are not legally required to appoint a Data Protection Officer, so privacy requests are handled directly by us.

2. The Personal Data We Collect

What we collect depends on how you use the Services. In practice this covers:

  • Contact details such as your name, email address, phone number, billing address and shipping address.
  • Order and payment details such as the items you buy, order value, currency, delivery method, and confirmation that payment succeeded. We do not see or store your full card number; card data is entered directly with our payment providers.
  • Account details if you create an account, such as your login credentials, saved addresses and preferences.
  • Communications such as the content of emails, contact form messages and support enquiries you send us.
  • Newsletter data such as your email address, your consent record, and whether you opened or clicked our emails.
  • Device and usage data such as your IP address, browser and device type, pages viewed, products viewed or added to cart, referring website, and similar analytics data collected through cookies and comparable technologies.

We collect this data directly from you, automatically as you use the store, and from the service providers who operate parts of the store on our behalf.

3. Why We Use Your Data and Our Legal Basis

Under the GDPR we must have a legal basis for every use of your personal data. Ours are:

What we do Legal basis
Process your order, take payment, arrange shipping, handle returns, exchanges and warranty issues, and manage your account Performance of a contract with you (Art. 6(1)(b) GDPR)
Answer your questions and provide customer support Performance of a contract, or our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR)
Keep invoices, order records and other commercial and tax documents Compliance with a legal obligation (Art. 6(1)(c) GDPR)
Prevent fraud, secure the store, and protect our legal rights Our legitimate interest in a safe and functioning store (Art. 6(1)(f) GDPR)
Send you our newsletter and promotional emails, including the 5% first-order discount Your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
Set non-essential cookies and measure how the store is used through analytics Your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG)
Operate the store, run essential cookies, and improve our products and service Our legitimate interest in running and improving our business (Art. 6(1)(f) GDPR)

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms. You can object to that processing at any time (see Your Rights below).

4. Newsletter and Marketing

You only receive marketing emails from us if you have signed up for them. When you subscribe, we record your email address and the fact that you consented, which is how we demonstrate compliance if asked. Every newsletter contains an unsubscribe link, and you can also unsubscribe by emailing us. Withdrawing consent does not affect the lawfulness of emails sent before you withdrew it. Even after you unsubscribe, we may still send you service messages about an order you have placed.

You can review and change how your data is used for personalised advertising on our Your Privacy Choices page.

5. Cookies and Similar Technologies

Our store uses cookies and similar technologies. Some are strictly necessary — they keep you logged in, remember your cart, apply your language and currency, and keep checkout secure. These are set on the basis of our legitimate interest, because the store cannot work without them.

Other cookies are optional. These include analytics cookies, which tell us how the store is used, and marketing cookies, which may be used to show relevant advertising. Optional cookies are only set with your consent, and you can change or withdraw that consent at any time through the cookie settings on our site or through our Your Privacy Choices page. You can also block or delete cookies in your browser settings, though some parts of the store may then stop working properly.

6. Who We Share Your Data With

We do not sell your personal data. We share it only where it is needed to run the store, and only with parties bound to protect it:

  • Shopify, which hosts our store and processes order, customer and analytics data on our behalf as our processor.
  • Our payment providers, who process your payment and carry out fraud and anti-money-laundering checks. They act as independent controllers for parts of this processing and apply their own privacy notices.
  • Our shipping and logistics partners, who receive the name, delivery address and contact details needed to deliver your parcel and to send you tracking updates.
  • Marketplaces and sales channels where you placed your order, if you bought from us somewhere other than our own store.
  • Our email, analytics and IT service providers, who help us send messages, host data and keep the store running.
  • Our tax adviser and, where required, public authorities, where we are legally obliged to disclose data or need to establish, exercise or defend legal claims.

Where these parties act as our processors, they may only use your data on our instructions and under a data processing agreement.

7. Our Relationship with Shopify

Our store runs on Shopify, which hosts the Services and processes personal data about your visit and your orders so that the store can function. Shopify may also process some data for its own purposes, for example to secure and improve its platform and to support certain enhanced merchant features. For that processing Shopify is responsible as controller. You can read more in the Shopify Consumer Privacy Policy and manage related choices through the Shopify Privacy Portal.

8. International Data Transfers

Some of our service providers, including Shopify, operate outside the European Economic Area. Where your personal data is transferred to a country outside the EEA, we make sure it is protected — either because the European Commission has decided that country offers an adequate level of protection, or by using the European Commission's Standard Contractual Clauses together with any additional safeguards that are needed. You can ask us for more detail about the safeguards in place by emailing us.

9. How Long We Keep Your Data

We keep your personal data only as long as we need it, and then delete it or restrict access to it:

  • Order, invoice and accounting records: retained for the statutory retention periods under German commercial and tax law, which are generally up to 10 years (§ 257 HGB, § 147 AO).
  • Customer account data: kept while your account is open. If you close it or ask us to delete it, we remove your account data apart from records we must keep for tax or legal reasons.
  • Newsletter data: kept until you unsubscribe or withdraw consent, after which we keep only a minimal record of the withdrawal so we do not contact you again.
  • Support and contact messages: kept while your query is open and afterwards for as long as needed to handle any follow-up or potential claim, normally no longer than three years from the end of the year in which the matter was closed.
  • Cookies and analytics data: kept for the lifetime of the relevant cookie or the retention period of the analytics tool, whichever is shorter.

10. How We Protect Your Data

We use appropriate technical and organisational measures to protect your data, including encrypted connections across our store and checkout, restricted access to customer data, and providers who maintain their own security standards. No system can be completely secure, so please avoid sending sensitive or confidential information to us through unsecured channels.

11. Your Rights

Under the GDPR you have the following rights over your personal data:

  • Access — to be told whether we process your data and to receive a copy of it (Art. 15).
  • Rectification — to have inaccurate or incomplete data corrected (Art. 16).
  • Erasure — to have your data deleted where there is no longer a valid reason for us to keep it (Art. 17).
  • Restriction — to have our processing limited in certain situations, for example while a dispute about accuracy is resolved (Art. 18).
  • Data portability — to receive the data you gave us in a common, machine-readable format and to have it sent to another provider (Art. 20).
  • Objection — to object to processing based on our legitimate interests, and to object at any time and without giving a reason to the use of your data for direct marketing (Art. 21).
  • Withdrawal of consent — to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
  • Automated decisions — not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you (Art. 22). We do not make such decisions.
  • Complaint — to lodge a complaint with a data protection supervisory authority (Art. 77), as described below.

To exercise any of these rights, simply email us. We answer within one month, and will tell you if we need longer because a request is complex. We may need to verify your identity first, and you may appoint someone to act on your behalf if they can show they are authorised. Exercising your rights is free and we will never treat you differently for doing so.

12. Complaints and Supervisory Authority

If you are unhappy with how we handle your data, please contact us first — we would like the chance to put it right. You also have the right to complain to a data protection supervisory authority, either in the EU country where you live or work, where the alleged infringement took place, or where we are established. As we are based in Berlin, the competent authority for us is the Berlin Commissioner for Data Protection and Freedom of Information. A list of EEA supervisory authorities is available from the European Data Protection Board.

13. Children's Data

Our Services are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Third-Party Websites and Links

Our store may link to websites and platforms we do not operate, such as social media pages or partner sites. We are not responsible for their content, privacy practices or security. Please read their own privacy notices before sharing personal data with them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in legal requirements. The current version is always published on this page with the date it was last updated. If a change materially affects you, we will give you notice as required by law.

For any privacy questions or to exercise your rights, reach us anytime at: info@damascusbox.com or via our Contact page.