Privacy

This policy applies to diabet.store and diabet.care. It explains which personal data we process, why, and on what legal basis. Last updated: October 2026.

1. Controller

Sergej Litvinovskiy
Barkhausenweg 11
22339 Hamburg
Germany
Email: diabet.care@gmail.com

We have not appointed a data protection officer, as the law does not require one. For any privacy question, contact us at the address above.

2. No tracking

We use no analytics, advertising or tracking services and build no user profiles. Fonts load from our own server. No automated decision-making within the meaning of Art. 22 GDPR takes place.

3. Cookies and local storage

We only store what is technically necessary on your device (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR):

  • a session cookie for sign-in and checkout, deleted when you close your browser;
  • entries in your browser’s local storage for the cart, your chosen language and the display mode (light/dark). This data leaves your device only when you place an order.

No consent is required for this. You can delete this data at any time in your browser settings.

4. Customer account

For a customer account we process your email address, your password (only as an encrypted hash), your name, phone number, saved delivery addresses and order history. To handle your orders we may keep internal notes on your account that only administrators can see. The legal basis is Art. 6(1)(b) GDPR. You can ask us by email to delete your account at any time. Data we must keep for tax or commercial-law reasons is blocked until the retention period ends.

5. Orders and payment

For orders we process your name, delivery address, email address, phone number where given, the items ordered and payment information (Art. 6(1)(b) and (c) GDPR). The products ordered can indicate diabetes. We use this information only to fulfil your order and do not pass it on for any other purpose.

Payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Card payments also go through PayPal. We send PayPal the order amount, the items ordered and the delivery country; you enter your payment details directly with PayPal and we never receive them. PayPal’s privacy statement also applies: paypal.com/de/legalhub/privacy-full.

6. Shipping

For delivery we pass your name and delivery address, and for express shipments or deliveries outside the EU also your phone number and email address, to DHL (Deutsche Post AG / DHL Express Germany GmbH, Bonn) (Art. 6(1)(b) GDPR). For deliveries outside the EU, the customs documents contain your name, address and the contents of the parcel; this data goes to the customs authorities of the destination country (Art. 6(1)(c) GDPR).

7. Email

We send order confirmations, order status updates and account emails (Art. 6(1)(b) GDPR). We do not send marketing emails or newsletters. If you write to us, we process your message and email address to reply (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

To prevent abuse, at registration we check that the domain of your email address can receive email and does not belong to a disposable-address provider. Only the domain is looked up, not your address.

8. Abuse protection (Cloudflare Turnstile)

On the sign-in and registration forms we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to detect automated access. Your IP address and technical characteristics of your browser are sent to Cloudflare. The legal basis is our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework. Details: cloudflare.com/privacypolicy.

9. YouTube videos

Videos on our product pages load only when you click them. Until then there is no connection to YouTube. After the click, your browser loads the video in privacy-enhanced mode (youtube-nocookie.com) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address and the page you are on, among other data, are sent to Google; transfer to Google LLC in the USA is possible. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Details: policies.google.com/privacy.

10. Address assistance

When you enter an address, we suggest places that match the postcode. The GeoNames data used for this sits on our own server; your input is not sent to any third party.

11. Retention

We delete personal data once its purpose no longer applies. Order and invoice data is kept for up to 10 years under statutory obligations (§ 147 AO, § 257 HGB), business correspondence for up to 6 years. Account data is deleted when you have your account deleted, unless a retention obligation applies.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). An email to us is enough.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

13. Changes

We update this policy when our websites or the law change. The version published here applies.