Privacy Policy

1) Information on the collection of personal data and contact details of the responsible party

1.1 We're glad you're visiting our website and thank you for your interest. Below, we explain how we handle your personal data when you use our site. Personal data means any data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Yala. The controller for the processing of personal data is the person or entity that, alone or together with others, decides on the purposes and means of processing personal data.

1.3 To protect personal data and other confidential content (such as orders or enquiries) during transmission, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" in the address bar and the padlock symbol in your browser.

2) Collection of data when visiting our website

If you use our website for informational purposes only — meaning you don't register or otherwise submit information — we only collect the data your browser automatically sends to our server (so-called "server log files"). This includes:

• The page visited
• Date and time of access
• Amount of data transferred in bytes
• Source/referrer that brought you to the page
• Browser used
• Operating system used
• IP address (anonymised where applicable)

This processing takes place under Article 6(1)(f) GDPR based on our legitimate interest in keeping our website stable and functional. The data is not passed on or used for any other purpose. We do reserve the right to review server log files retroactively if there are concrete indications of unlawful use.

By using our website, you agree that third parties may process your IP address to determine your location for currency conversion purposes. You also agree that this currency is stored in a session cookie in your browser (a temporary cookie that is automatically removed when you close your browser). We do this so the selected currency stays consistent while you browse, and prices can be shown in your local currency.

3) Cookies

To make our website work properly and to enable certain features, we use cookies on various pages. Cookies are small text files stored on your device. Some of the cookies we use are deleted as soon as your browser session ends (session cookies). Others stay on your device and let us — or our partners — recognise your browser on your next visit (persistent cookies). Persistent cookies are automatically deleted after a set period.

Some cookies are used to simplify the ordering process, for example by saving the contents of your shopping basket for a later visit. If personal data is processed via cookies we use, this is done either under Article 6(1)(b) GDPR for performance of a contract, or under Article 6(1)(f) GDPR to safeguard our legitimate interest in a well-functioning, customer-friendly website.

We may work with advertising partners that help us make our website more relevant to you. For this purpose, third-party cookies may also be stored on your device.

Use of Google services

We use services from Google (such as Google Analytics and Google Ads) to better understand how visitors use our site and to improve our services. These services may set cookies and process personal data such as IP addresses and usage behaviour. For more information on how Google handles your data, please see Google's privacy policy: https://business.safety.google/privacy/

You can configure your browser to notify you about cookies and decide case by case whether to accept them, or to block cookies in certain situations or entirely. Each browser handles cookie settings differently. You can find instructions in your browser's help menu, for example:

• Chrome: https://support.google.com/chrome/answer/95647
• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
• Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies

If you don't accept cookies, the functionality of our website may be limited.

4) Contact

When you contact us — for example through our contact form or by email — we collect personal data. Which data is collected through the contact form is shown on the form itself. This data is stored and used solely to respond to your enquiry and for the related technical administration. The legal basis for this processing is our legitimate interest in responding to you, under Article 6(1)(f) GDPR. If your enquiry is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) GDPR. Your data is deleted once your enquiry has been fully handled, unless circumstances require us to retain it.

5) Data processing when opening a customer account and for order fulfilment

In line with Article 6(1)(b) GDPR, we collect and process personal data you provide to us for the purpose of performing a contract or creating a customer account. The required information is shown on the relevant input forms.

You can delete your customer account at any time by sending a message to Yala using the contact details provided. We store and use the data you provide to process your contract. After your contract has been completed or your customer account is deleted, your data is blocked in line with applicable tax and commercial retention periods, and deleted once those periods expire.

6) Use of your data for direct advertising: email newsletter subscription

If you subscribe to our email newsletter, we'll send you regular updates about our products and offers. The only mandatory information needed to send you the newsletter is your email address. Any additional information you provide is voluntary and used to address you personally.

We use a double opt-in procedure. This means we only send you a newsletter once you have explicitly confirmed that you consent to receive it. After signing up, we send you a confirmation email asking you to click a link to verify your subscription.

By activating that confirmation link, you give us your consent to use your personal data under Article 6(1)(a) GDPR. When you subscribe, we store your IP address as provided by your Internet Service Provider, along with the date and time of registration, so that any potential misuse of your email address can be traced later.

The data collected when you subscribe is used exclusively for newsletter advertising. You can unsubscribe at any time using the link in any newsletter or by sending us a message. Once you unsubscribe, your email address is removed from our newsletter list immediately.

7) Data processing for order fulfilment

7.1 Personal data we collect is passed on to the carrier responsible for delivery, to the extent needed to deliver your order. Payment data is passed on to the relevant financial institution as part of payment processing, to the extent needed for that purpose. Where payment service providers are used, we explain this below. The legal basis for the data transfer is Article 6(1)(b) GDPR.

7.2 To fulfil our contractual obligations to customers, we work with external shipping partners. We share your name and delivery address with the shipping partner we have selected, solely for the purpose of delivering your order, in line with Article 6(1)(b) GDPR.

7.3 Use of payment service providers

Shopify Payments (including Shop Pay, Apple Pay and Google Pay)

Payments on our website are processed via Shopify Payments, operated by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you place an order, the information you provide during checkout — together with information about your order — is transferred to Shopify Payments in accordance with Article 6(1)(b) GDPR, solely for the purpose of processing your payment and only to the extent necessary.

Depending on the payment method you select (for example Shop Pay, Apple Pay or Google Pay), additional data may be processed by the relevant provider. More information about how Shopify processes your data can be found in Shopify's privacy policy: https://www.shopify.com/legal/privacy

8) Rights of the data subject

8.1 Applicable data protection law gives you broad rights regarding the processing of your personal data. Specifically, you have:

• The right of access under Article 15 GDPR
• The right to rectification under Article 16 GDPR
• The right to erasure under Article 17 GDPR
• The right to restriction of processing under Article 18 GDPR
• The right to be informed under Article 19 GDPR
• The right to data portability under Article 20 GDPR
• The right to withdraw consent under Article 7(3) GDPR
• The right to lodge a complaint under Article 77 GDPR

8.2 Right to object

If we process your personal data on the basis of overriding legitimate interests, you have the right to object to this processing at any time, on grounds relating to your particular situation, with effect for the future. If you exercise your right to object, we will stop processing the data concerned. Further processing remains reserved if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object to this processing at any time. If you object, we will stop processing your data for direct marketing purposes.

9) Duration of storage of personal data

How long we store personal data depends on the relevant statutory retention period (for example, commercial and tax retention periods). Once that period has expired, the data is routinely deleted, provided it is no longer needed to fulfil or initiate a contract and we have no legitimate interest in storing it further.