Last updated: 14 November 2026

1. Controller

Molliora GmbH, Kennedystraße 25, 63477 Maintal, Germany · hello@carebymolliora.com · +49 162 2382680. Managing directors: Carl Martinsson, Helena Sundin.

2. What we process and why

Orders: name, addresses, email, phone, order and payment details, to perform the contract (Art. 6(1)(b) GDPR) and to meet statutory retention duties (Art. 6(1)(c) GDPR; up to 10 years for tax records).

Customer account: if you create one, the data you provide, to manage your orders (Art. 6(1)(b) GDPR).

Contact: when you write or call us, we process your message to answer it (Art. 6(1)(b) or (f) GDPR).

Newsletter: only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the link in every email.

Server logs: IP address, time and pages requested, to operate and secure the website (Art. 6(1)(f) GDPR).

3. Recipients

We share data only as needed with: our hosting provider (Namecheap, Inc., EasyWP); our payment providers (Stripe Payments Europe Ltd.; PayPal (Europe) S.à r.l. et Cie, S.C.A.); our fulfilment partner, who produces and ships your order within the EU; shipping carriers; Google Ireland Ltd. (business email); and, where enabled, our customer chat and email marketing providers. Where data is transferred outside the EU, this is based on EU standard contractual clauses or an adequacy decision.

4. Cookies

We use cookies that are technically necessary for the shop to work (cart, checkout, login). Any analytics or marketing cookies are used only with your consent, which you can change at any time in the cookie settings.

5. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent with effect for the future. To exercise them, write to hello@carebymolliora.com. You also have the right to lodge a complaint with a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden.

6. Retention

We delete personal data when it is no longer needed for the purposes above, unless statutory retention periods apply.