Privacy Policy

Last updated: 9 November 2026

Thank you for your interest in Naya Sorelle. Protecting your personal data is important to us. Below we explain which data we process when you visit our online shop at nayasorelle.com, place an order or contact us, why we do so and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Adaeze Best Ozoemena, trading as Naya Sorelle
Dornberger Straße 512, 33619 Bielefeld, Germany
Phone: +49 1575 2056283
Email: info@nayasorelle.com

We are not required to appoint a data protection officer. For any data protection questions, please contact us at the address above.

2. Hosting and shop system (Shopify)

Our online shop runs on the e-commerce platform Shopify, operated for the EU by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland. Shopify stores and processes on our behalf all data that arises when you use the shop, for example your IP address, browser information, pages visited, the content of your shopping cart, order and customer data. Shopify may transfer data to Shopify Inc. in Canada and to service providers in the USA. Canada has an EU adequacy decision; transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. We have concluded a data processing agreement with Shopify.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR (our legitimate interest in a secure, stable and efficient online shop). More information: shopify.com/legal/privacy.

3. Server log files

When you visit our website, technical data is automatically recorded in server log files (IP address, date and time of access, page visited, referring page, browser and operating system). This data is needed to deliver the website and to ensure its security and is deleted after a short period. Legal basis: Art. 6 (1) (f) GDPR.

4. Cookies and consent

We use cookies and similar technologies. Technically necessary cookies (for example for the shopping cart, checkout and your cookie choices) are used on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR. All other cookies and similar technologies, for example for statistics, marketing and personalised content, are only used if you have given your consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change or withdraw your consent at any time with effect for the future, for example by deleting the cookies in your browser, after which the cookie banner will be shown again.

5. Orders and customer account

When you place an order, we process the data required to process your order: name, billing and delivery address, email address, phone number (if provided), order details and payment information. You can also create a customer account to view your orders. Legal basis: Art. 6 (1) (b) GDPR. Due to commercial and tax law retention obligations (§ 147 AO, § 257 HGB), we store order and invoice data for up to 10 years (Art. 6 (1) (c) GDPR); after that it is deleted.

6. Payment

Payments are processed via Shopify Payments, including Shop Pay, Apple Pay, Google Pay, credit and debit cards and other payment methods offered at checkout. Shopify Payments is provided in the EU by Shopify Payments (Ireland) Limited; card payments are processed by Stripe Payments Europe Ltd., Dublin, Ireland. If you choose Apple Pay or Google Pay, the respective provider (Apple Distribution International Ltd., Ireland, or Google Ireland Ltd.) also processes your payment data under its own privacy policy. We do not store your full card details ourselves. Legal basis: Art. 6 (1) (b) GDPR; for fraud prevention Art. 6 (1) (f) GDPR.

7. Shipping

To deliver your order, we pass your name, delivery address and, where needed for delivery notifications, your email address or phone number to the shipping company we use, in particular DHL / Deutsche Post AG, Bonn, Germany. Legal basis: Art. 6 (1) (b) GDPR; where you agree to delivery notifications, Art. 6 (1) (a) GDPR.

Our physical book "The Naya Hair Method" is printed on demand and shipped directly by our print partner Lulu Press, Inc., Morrisville, North Carolina, USA. For this purpose we pass your name, delivery address, email address and order details to Lulu. Data is transferred to the USA on the basis of EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (b) GDPR.

8. Digital products

When you buy an e-book or other digital product, we process your name, email address and order details to give you access to the download. Legal basis: Art. 6 (1) (b) GDPR.

9. Newsletter and email marketing (Omnisend)

If you sign up for our newsletter, we use your email address (and your name, if provided) to send you information about hair care, our products, launches and offers. We use the double opt-in procedure: you will receive an email asking you to confirm your sign-up. We use the email marketing service Omnisend, operated by Omnisend UAB, Vilnius, Lithuania, which also measures whether emails are opened and links are clicked so we can improve our newsletter. Legal basis: your consent, Art. 6 (1) (a) GDPR. You can unsubscribe at any time via the link in every email or by writing to info@nayasorelle.com.

If you have bought from us, we may send you emails about similar products of our own without separate consent (§ 7 (3) UWG). You can object to this at any time free of charge.

10. Sign-up pop-ups (Sendwill)

We use the Shopify app Sendwill Email Popups to show sign-up forms and promotions (for example "Spin to win"). If you enter your email address in such a form, it is used to send you the promised discount and, if you agree, our newsletter. Legal basis: Art. 6 (1) (a) GDPR. The app is only loaded after your consent via the cookie banner where required.

11. Product reviews (Judge.me)

We use the review service Judge.me to collect and display product reviews. After a purchase, we may send you an email asking you to review the product. If you write a review, your name (or the name you choose), your review text, star rating and any photos you upload are published on our website. Legal basis: Art. 6 (1) (b) and (f) GDPR (our legitimate interest in showing genuine customer reviews); for review request emails, Art. 6 (1) (f) GDPR and § 7 (3) UWG. You can object to review requests at any time.

12. Spam protection (Google reCAPTCHA)

To protect our forms (for example contact, sign-up and customer account forms) against spam and abuse, Shopify uses Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses certain usage data (including your IP address) to check whether an entry is made by a human. Data may be transferred to Google LLC in the USA on the basis of the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (f) GDPR (protection against misuse).

13. YouTube videos

Some pages contain videos from YouTube (Google Ireland Limited). The videos are embedded in privacy-enhanced mode and are only loaded when you click on them. Only then is a connection to YouTube's servers established and data such as your IP address is transferred to Google; if you are logged in to your Google account, YouTube may link your visit to your account. Legal basis: your consent by clicking, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

14. Fonts

The fonts on our website are stored on our own Shopify server. No connection to Google Fonts or other external font servers is established when you visit our website.

15. Contact

If you contact us by email, phone, social media or via our contact form, we process your details to answer your request. Legal basis: Art. 6 (1) (b) GDPR if your request relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete the data once your request has been dealt with, unless legal retention obligations apply.

16. Workshops and consultations

If you book a workshop or a personal consultation, we process your name, contact details and the information you give us to organise and carry out the appointment. For consultations, you may choose to share information about your hair, scalp or health; we only use this to advise you, and only with your consent (Art. 9 (2) (a) GDPR). Legal basis otherwise: Art. 6 (1) (b) GDPR.

Consultation appointments are booked with the Shopify app Appointo (provider: Sidepanda). For this, your name, email address, phone number, the booked date and time and your answers to the booking questions are processed. Online consultations take place via Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); data may be transferred to Google LLC in the USA on the basis of the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (b) GDPR.

17. Social media, sales channels and marketing pixels

Our website contains simple links to our profiles on Instagram and TikTok. No data is transferred to these platforms until you click on a link and visit the platform; the platform's own privacy policy then applies.

We also offer our products via the TikTok, Pinterest and Google & YouTube sales channels and use their marketing tools: the TikTok Pixel (TikTok Technology Limited, Dublin, Ireland), the Pinterest Tag (Pinterest Europe Ltd., Dublin, Ireland) and the Google tag (Google Ireland Limited, Dublin, Ireland). With your consent, these tools record which pages you visit and actions such as adding products to the cart or completing a purchase, so that we can measure the success of our advertising and show you relevant ads. The providers may link this data to your account on their platform and transfer it to the USA on the basis of the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. These tools are only active if you have accepted marketing cookies in our cookie banner. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future.

18. Recipients and data transfers

We only pass your data to third parties if this is necessary to process your order, if you have consented or if we are legally obliged to do so. Our service providers process data on our behalf on the basis of data processing agreements (Art. 28 GDPR). Where data is transferred to countries outside the EU/EEA, this is done on the basis of an adequacy decision, the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.

19. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR). To exercise your rights, simply email info@nayasorelle.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

20. Changes to this privacy policy

We update this privacy policy when our website, our services or the law change. The current version is always available on this page.