Privacy Policy
Last updated: 20.09.2026
This policy applies to the online shop at zambilo.de and the „Zambilo“ mobile apps for iOS (Apple App Store) and Android (Google Play Store) (together, the “Platform”).
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Fateme Alipoor Khomearan Weißdornweg 4 22393 Hamburg Germany Phone: +49 151 41349312 Email: info@zambilo.de
We have not appointed a data protection officer; in our assessment there is no legal obligation to do so (Section 38 BDSG).
2. Scope and principles
This policy covers the processing of personal data through the zambilo.de online shop and the mobile apps. The Platform is aimed at consumers (B2C). We process personal data solely in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Minors
Our Platform is aimed at persons of full legal age. Persons under 16 should not send us personal data without the consent of a parent or guardian. We do not knowingly collect data from children; if we become aware of such data, we delete it without delay. Consent given by minors is only valid subject to Article 8 GDPR.
4. Registration and customer account
Data processed: first and last name, billing address, alternative delivery addresses, email address, phone/mobile number, selected language, email notification setting and your order history.
Purpose: creating and managing the customer account, handling orders and the business relationship, communicating with you.
Legal basis: Article 6(1)(b) GDPR (contract and pre-contractual measures); where we check entries for plausibility, Article 6(1)(f) GDPR (legitimate interest in preventing fraud and misuse); where legally required, Article 6(1)(c) GDPR.
A customer account is required to use the Platform; we currently do not offer guest checkout.
5. One-time password (OTP) authentication
Sign-in and certain security-relevant operations are passwordless and use one-time passwords (OTP) that we send by email and/or SMS to the address or mobile number you have registered.
Data processed: email address or mobile number, the generated OTP code (held only briefly), timestamps, and session/token information to keep you signed in.
Recipients / processors: for SMS delivery we use Twilio (Twilio Inc., 101 Spear Street, San Francisco, CA, USA; “Twilio Verify” service); your mobile number is transmitted to Twilio. For email delivery we use STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.
Purpose: secure, passwordless authentication and protection against unauthorised access.
Legal basis: Article 6(1)(b) GDPR (performance of the usage/purchase contract) and Article 6(1)(f) GDPR (legitimate interest in account security).
6. Orders, delivery, invoices and withdrawal
Data processed: order and cart data, chosen delivery method and address, order notes, redeemed discount codes, order status and history, payment method and payment status, invoice data and invoice documents (PDF). Invoices are stored in a private, access-protected object store and are served only through authenticated endpoints (your own orders, or administration).
Purpose: processing orders and purchase contracts, delivery, invoicing and accounting.
Withdrawal, returns and warranty: if you withdraw from the contract or assert warranty rights, we process the data required for this (order and contact data, details of the goods and the defect, and bank details for the refund where it is not made via the original payment method).
Legal basis: Article 6(1)(b) GDPR (contract and its reversal) and Article 6(1)(c) GDPR (commercial and tax retention and record-keeping obligations, in particular Section 147 AO, Section 257 HGB, and food law requirements).
7. Payment processing via Mollie
We use Mollie to process online payments:
Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands (registered with the Dutch Chamber of Commerce under number 30204462). Mollie is a payment service provider licensed and supervised by the Dutch central bank (De Nederlandsche Bank, DNB).
Data processed: name and address, email address, billing and delivery address, order number and amount, chosen payment method, payment status and payment-related identifiers. In addition, the data required for the payment itself (e.g. card number, expiry date, security code, IBAN) and technical data such as IP address and device and browser information.
Entry of payment details: to pay, you are redirected to a payment page operated by Mollie, or you enter your details into input fields provided by Mollie. Full payment details go directly to Mollie and are not stored on our servers; we receive only status information and a truncated identifier (e.g. card type and the last four digits) to match the payment to the order. Depending on the payment method chosen, Mollie passes the necessary data on to the relevant provider, such as your bank or the card network.
Strong customer authentication: card payments may require authentication under the Second Payment Services Directive (PSD2, e.g. 3-D Secure). This involves transmitting data to your card issuer or the relevant payment service provider.
Mollie's role: Mollie processes payment data as a controller in its own right, in particular to execute the payment, to prevent fraud and to meet its own regulatory, anti-money-laundering and payment-services obligations. Processing takes place within the European Union. See Mollie's privacy policy at mollie.com/legal/privacy.
Purpose: executing and securing the payment, refunds, handling complaints and chargebacks, accounting.
Legal basis: Article 6(1)(b) GDPR (performance of the purchase contract including payment), Article 6(1)(f) GDPR (legitimate interest in secure, fraud-free payment processing) and Article 6(1)(c) GDPR (statutory obligations of the payment service provider).
8. Fraud prevention and creditworthiness
Fraud prevention: Mollie checks payments automatically for indications of fraud and financial crime. This evaluates transaction, device and connection data and condenses them into a risk score; suspicious payment attempts may be declined or flagged for manual review. Mollie carries out these checks as a controller in its own right and partly in fulfilment of statutory obligations. The legal basis is Article 6(1)(f) GDPR (legitimate interest in preventing payment default and fraud), Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.
Credit checks: we do not obtain credit reports about you. If we offer payment methods involving advance performance in future (e.g. purchase on account, instalments or direct debit via a third party), the respective payment service provider may carry out identity and credit checks as a controller in its own right; we would tell you before you select that payment method and update this policy accordingly.
9. Notifications, emails and marketing
Transactional messages: we show notifications in your customer account (e.g. order and payment status) and send transactional emails depending on your settings. We currently do not use operating-system push notifications; if offered in future, they will require your consent at device level. Legal basis: Article 6(1)(b) GDPR.
Newsletter and marketing emails: we send marketing emails only with your express consent (Article 6(1)(a) GDPR); we use double opt-in to confirm the subscription and log the sign-up, confirmation, time and IP address as evidence (Article 6(1)(f) GDPR). If you have placed an order with us, we may use your email address to advertise our own similar goods under Section 7(3) UWG (Article 6(1)(f) GDPR).
Withdrawal: you can withdraw your consent at any time with future effect, or object to marketing use at any time — via the unsubscribe link https://www.zambilo.de/newsletter/abmelden or by writing to info@zambilo.de. We then store your email address on a suppression list to prevent further mailings.
10. Contact form
If you use our contact form, we process the data you provide (in particular name, email address and message) in order to handle your enquiry. To protect against automated misuse (spam/bots) we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA, USA). Technical information (including IP address and browser data) is transmitted to Cloudflare.
Legal basis: Article 6(1)(b) GDPR (initiating/performing the contractual relationship) or Article 6(1)(f) GDPR (legitimate interest in handling enquiries and in spam/abuse protection).
11. Server log files and hosting
When you access the Platform, technical access data are processed automatically, in particular IP address, date and time, the resource requested, status code, volume of data transferred, referrer and user agent. These data serve secure operation, stability and the defence against attacks (including automated blocking of suspicious IP addresses).
Hosting / backups: the Platform is operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the server is located in a data centre in Finland (Helsinki, HEL1-DC4). Encrypted backups are stored at Hetzner within the EU. A data processing agreement under Article 28 GDPR is in place. Germany and Finland are within the EU/EEA; no transfer to a third country takes place as a result.
Log file retention: 14 days, after which log files are deleted automatically. Block lists kept by security services (e.g. fail2ban) may persist somewhat longer for the duration of the respective block.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in security and functionality).
12. Cookies and similar technologies
We use cookies and comparable technologies (e.g. localStorage). For strictly necessary technologies we rely on Section 25(2) TDDDG; for non-essential technologies we obtain your prior consent (Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR), which you can withdraw or change at any time via the “Cookie settings” button.
Strictly necessary cookies/storage currently in use:
Name
Purpose
zambilo_access_token, zambilo_refresh_token
Sign-in/session (httpOnly, secure), required for authenticated access
zambilo_locale
Stores your chosen language
zambilo_cookie_consent
Stores your cookie decision
Mollie cookies
Set only on the payment page operated by Mollie; required to execute and secure the payment
Cloudflare Turnstile cookies
Contact page only, to protect against bot abuse
The payment itself takes place on a page operated by Mollie. No third-party scripts or cookies are loaded for this purpose on our own pages.
Optional categories (analytics/marketing): we currently use no analytics or marketing cookies and no tracking or audience-measurement services. Should we use such services in future, this will happen only with your prior consent via our cookie banner, and this policy will be updated accordingly.
13. Map display (Google Maps)
On our website we may embed a Google Maps map to show our location (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC, USA). The map does not load automatically: it is displayed only after you have consented to the “functional” category in our cookie banner or have explicitly requested the map by clicking “Load map”. Only then are data (including your IP address) transmitted to Google, and Google may set cookies.
Legal basis: Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent).
14. Fonts
The fonts used on the Platform are served locally from our own servers (self-hosted). No connection is made to third-party servers (e.g. Google Fonts, CDNs) and your IP address is not transmitted to third parties.
15. Use of the mobile apps
Local storage: sign-in/session tokens are stored securely on your device (Secure Store/Keystore or Keychain) and are not passed on to third parties.
Camera (barcode scanner): with your permission, the app uses the camera to scan product barcodes (EAN) and open the matching product. The camera image is processed locally on the device; no images are stored or transmitted — only the recognised barcode is sent to our server for the product lookup. You can revoke the permission at any time in your device settings.
Payment in the app: for payments, the app redirects you to the payment page operated by Mollie. Depending on your device and selection, Apple Pay or Google Pay may be used, in which case payment data are processed by Apple (Apple Inc./Apple Distribution International Ltd.) or Google (Google Ireland Limited/Google LLC) and Mollie. We do not receive full card details.
No tracking: the app contains no analytics or advertising SDKs, and no cross-device tracking (Apple App Tracking Transparency / advertising IDs) takes place. Device data processed during Mollie's payment flow serve payment processing and fraud prevention only.
App stores: the app is obtained and updated via the Apple App Store (Apple Distribution International Ltd., Ireland; Apple Inc., USA) or Google Play (Google Ireland Limited, Ireland; Google LLC, USA). These providers process data as controllers in their own right under their respective privacy policies.
Legal basis: Article 6(1)(b) GDPR (contract) and Article 6(1)(f) GDPR (functionality/security); for camera access, additionally your device-level permission.
16. Recipients and processors
Within our business, your data are passed only to the departments responsible. Beyond that, we use carefully selected service providers as processors (Article 28 GDPR) or pass data to the following recipients where necessary:
Recipient
Purpose
Hetzner Online GmbH, Germany
Hosting and backups (server in Finland, EU)
Mollie B.V., Netherlands
Payment processing, fraud prevention, refunds — as a controller in its own right
Twilio Inc., USA
Sending SMS one-time passwords
STRATO AG, Germany
Sending emails (OTP, order and invoice notifications)
Cloudflare, Inc., USA
Bot/spam protection (Turnstile) on the contact page
Google Ireland Limited, Ireland
Map display on the website
Shipping and logistics providers
Delivery of ordered goods (recipient's name and address; email/phone for delivery notifications where applicable)
Tax advisors, authorities and courts
Where legally required or necessary to pursue legal claims
17. Transfers to third countries
Some of the above service providers (in particular Twilio, Cloudflare, Google and Apple) may transfer data to, or process data in, the USA. Where a transfer to a third country takes place, we base it on an adequacy decision (in particular the EU-US Data Privacy Framework, where the recipient is certified) under Article 45 GDPR, or on appropriate safeguards such as the European Commission's standard contractual clauses under Article 46 GDPR. Payment processing via Mollie takes place within the EU. For card payments, data may nevertheless be transmitted to card networks and the issuing bank, which may operate outside the EU; this is necessary to execute the payment (Article 49(1)(b) GDPR).
18. Retention and deletion
Account data: until the account is deleted (see below);
OTP codes: a few minutes only (short-lived cache);
Sessions/tokens: until sign-out or expiry;
Order, payment and invoice data: for the duration of the statutory retention periods (in particular 10 years under Section 147 AO / Section 257 HGB), then deleted;
Consent records (newsletter): for the duration of the evidentiary obligation, as a rule 3 years after the end of the year in which the consent was withdrawn;
Server log files: 14 days;
Backups: automatically overwritten/deleted as part of the backup rotation.
Mollie stores the payment data it processes as a controller in its own right, under the retention periods applicable to payment service providers.
Account deletion: you can delete your account yourself at any time — in the apps and in the shop via “Delete account” (Dashboard → Profile) or by email to info@zambilo.de. After confirmation, your personal data are deleted or anonymised; if there are no open orders, deletion takes place immediately, otherwise the account is blocked and anonymised after 14 days. Data subject to statutory retention obligations (in particular invoice and order data) are blocked for the retention period and deleted afterwards.
19. Your rights
Under the GDPR you have the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and a right to object to processing based on Article 6(1)(f) GDPR (Article 21). You may object to direct marketing at any time without giving reasons. You can withdraw any consent given at any time with future effect (Article 7(3) GDPR). A message to info@zambilo.de is sufficient to exercise your rights.
20. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority at our place of business is in particular:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit Ludwig-Erhard-Straße 22, 7th floor 20459 Hamburg Germany
21. Obligation to provide data
Providing the data required for registration, conclusion of the contract, payment and fulfilment is necessary in order to use the Platform. Without these data we cannot maintain a customer account, process a payment or fulfil orders.
22. Automated decision-making / profiling
We do not carry out decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR). As part of payment processing, Mollie performs an automated fraud check (see section 8); if this results in a payment being declined, you may choose a different payment method or contact us at info@zambilo.de to obtain human review and to state your point of view.
23. Changes to this privacy policy
We adapt this privacy policy when the legal situation or our processing activities change. The version published on the Platform at the time applies.
Fateme Alipoor Khomearan · Weißdornweg 4, 22393 Hamburg, Germany · info@zambilo.de